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ABSTRACT 


This thesis seeks to improve the Norwegian special operations forces’ tactical 
ability to counter domestic hybrid scenarios. The thesis answers two questions: which 
fundamental factors of the operational environment identify Russia’s new tactics, and 
how have allied nations’ special operations forces (SOF) improved their design after 
identifying similar challenges in their operational environments? Case studies of Russia’s 
hybrid warfare development in Georgia and on the Crimean Peninsula reveal that Russian 
cross-sectoral tactics create confusion and situational complexity. Russia exploits the 
confusion and hesitation and further complicates the situation by dominating the 
communicative domain to reach its strategic objective. 

Through a series of interviews, this study finds that Norwegian special operations 
forces (NORSOF) should establish a liaison element for interdepartmental 
communication, establish a generic concept of operation plan to provide a legal 
framework and guide for a NORSOF ground force, and function as a manual for civil 
authorities describing NORSOF capabilities. The thesis recommends enhancing 
NORSOF’s ground forces command and control (C2) abilities to better face complex 
situations. These suggestions will support NORSOF’s trust-building interdepartmental 
relations and improve NORSOF operational autonomy. 
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EXECUTIVE SUMMARY 


Russia does not want a conventional war with North Atlantic Treaty Organization 
(NATO) members. Russia fears NATO and considers the West to be hindering Russia’s 
attempt to restore her bygone greatness. By prodding for weak spots, Russia has, and is, 
successfully projecting hybrid threats toward the West to break down NATO’s integrity 
and seeks to gain from an unstable Western world. As the Arctic situation is changing— 
both in physical and political climate—Norway will remain a part of Russian foreign policy 
and must prepare its defense forces accordingly. As Russia fears NATO, any potential 
crisis and conflict with Norway will intentionally be held below any Article V scenario. 
This study assumes that because of its intent to remain below Article V, Russia will choose 
hybrid threats and rapid clandestine operations to reach its strategic objectives. This 
thesis’s primary goal is to identify how Norwegian special operations forces (NORSOF) 
may improve as a national hybrid countermeasure by first identifying new factors in 
NORSOF’s operational environment should NORSOF be employed to counter Russian 
hybrid threats or warfare in Norway and, from there, reviewing lessons learned from allied 
special operations forces to overcome the new challenges. By analyzing the initial phases 
of Russia’s war in Georgia and its annexation of Crimea, the thesis aims to recognize what 
tactically stands out in the operational environment in the analyzed conflicts. 

This study has three distinct factors that vary from regular military conflicts 
outlining the operational environment. The first, cross-sectoral conflict, describes the 
problems when soldiers are not marked as soldiers, and when civilian infrastructure and 
the civilian population becomes targeted as much as the military defense forces. The 
second, the need for rapid response, reveals that Russia takes advantage of being the more 
massive power in the situation, and utilizes its adversary’s hesitation for fear of escalating 
the conflict to maneuver and position its tactical tools. Despite being inferior in power and 
forces during the initial part of the annexation, Russia annexed Crimea without firing a 
single shot. Indications reveal that a rapid proper response from the Ukrainian forces could 
have stopped the annexation of Crimea. The third factor is Russian tactics that deliberately 
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create situational complexity and confusion through ambiguous appearance and control 
over communication and media. 

NORSOF’s proficiency to support Norwegian hybrid countermeasures must 
improve. First and foremost, cross-sectoral communication must advance to gain vital 
interdepartmental trust and bonds. Previous cross-sectoral challenges show that the 
interaction between the judicial and defense sectors remains at the ministry level. Tactical 
communication in future challenges will enhance the organization’s understanding and 
trust needed to function appropriately in a national crisis. Moreover, cross-sectoral 
communication on the tactical level is vital to gain a shared common situational 
understanding and situational awareness. By introducing a NORSOF liaison element 
mandated to enhance interdepartmental communication and break down cultural biases, 
local authorities may lower their threshold for requesting NORSOF’s support in times of 
crisis. Hopefully, enabling bilateral knowledge and understanding will facilitate an 
improved desire for regular interdepartmental exercises and training, another success 
criterion for cross-sectoral trust and understanding. Furthermore, a lower cross-sectoral 
communicative threshold can stimulate a rapid response from NORSOF as an 
organizational acquaintance, expediting the essential request from local authorities. 

Along with the liaison element, NORSOF should establish a generic concept of 
operations (CONOPS) to counterbalance a hybrid scenario’s complexity. CONOPS, as 
such, must include the legal framework and operational options, and suggest empowering 
NORSOF capabilities that may enhance a local chief of police. The CONOPS is not only 
to provide the NORSOF ground force operational confidence by describing its options and 
limitations, but also—just as relevant—to function as a manual for the local authority 
facing an unfamiliar situation in which it is not able to establish consultative 
communication with its central authorities. Lastly, NORSOF may amplify its ground 
force’s competence to act appropriately and prudently in a given hybrid scenario in a non- 
communicative chain-of-command. By including joint experience and increased political 
maturity in the deployed force’s leadership, NORSOF empowers the ground force to make 
more informed decisions. 
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I. 


INTRODUCTION 


The art of war teaches us to rely not on the likelihood of the enemy’s not 
coming, but on our own readiness to receive him; not on the chance of his 
not attacking, but rather on the fact that we have made our position 
unassailable. 

—Sun Tzu, The Art of War 1 

This thesis seeks to improve the Norwegian special operations forces’ ability to 
counter hybrid threats and hybrid warfare. On September 27, 2019, Norway woke up to a 
headline stating “Russian special forces on Norwegian soil.” 2 This headline from 
AldriMer.no, a defense-focused Norwegian online journal, raised eyebrows among its 
readers, stating that foreign military forces were operating in and therefore challenging 
Norway’s sovereignty. The article claimed that the Russian special warfare operators 
conducted reconnaissance against vital infrastructure in several places in Norway. 
Subsequently, both the Norwegian intelligence service and the Norwegian police security 
service (PST) repudiated the allegations by stating that no evidence could back up the 
claims. 3 Approximately a week later, one of Norway’s largest newspapers, the 
Aftenposten, reposted pictures gathered from social media of Russian special warfare 
operators’ photographs from Svalbard, Norway (see Figure 1 for geographical details). The 
special warfare operators used Svalbard as their designated stopover on their way to Arctic 
training at the North Pole. 4 

1 Sun Tzu, The Art of War (New York: Cosimo, Inc., 2010), 26. 

2 Kjetil Stormark, “Russiske Spesialstyrker Pa Norsk Jord [Russian Special Forces on Norwegian 
Soil],” Aldrimer, September 27, 2019, https://www.aldrimer.no/russiske-spesialstyrker-pa-norsk-jord/. 

3 0yvind Bye Skille, “E-tjenesten og PST: Ingenting som stptter pastander om russiske styrker pa 
norsk jord [Intelligence Service and PST: Nothing Supports Allegations of Russian Forces on Norwegian 
Soil],” NRK, September 30, 2019, https://www.nrk.no/norge/e-tjenesten-og-pst_-ingenting-som-stotter- 
pastander-om-russiske-styrker-pa-norsk-jord-1.14723193. 

4 Per Anders Johansen, “Her Er Bildene Til de Russiske Spesialsoldatene «pa Tur» Pa Svalbard [Here 
Are the Pictures of the Russian Special Soldiers ‘Touring’ at Svalbard],” Aftenposten, accessed January 4, 
2020, https://www.aftenposten.no/article/ap-GG8Qbq.html. 
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For this purpose of this thesis, special attention is given to the Barents Sea, Svalbard, and 
the Northern region of Norway. 

Figure 1. Thesis’s geographical area of focus 5 


Regardless of the authenticity of the allegations, the narrative illustrates the current 
situation in the high north. The tension and hostility between East and West has returned 
and nations across Europe debate how to face the challenge. Over the last decade, Russia 
has altered and developed its foreign policy tactics to reach its strategic objectives. Russia’s 
way of warfare has changed, and the West must study the resulting changes to prepare itself 
accordingly. Russia’s modernized concept of warfare, so-called hybrid warfare, blurs the 
lines of peace and war as it operates in the gray zone and prods for weak spots to exploit. 
The new warfare does not discriminate between civilians and the military, and it projects 
multi-domain tools in an asymmetric fashion towards its adversaries. Understanding how 
the new tactics change the operational environment is critical for the different national 


5 Google Maps, “Norway and Its Neighboring Countries,” Google Maps, February 22, 2020, 
https://www.google.eom/maps/place/Norway/@78.792861,60.9036545,2.2 lz/ 
data=!4m5!3m4!ls0x461268458f4de5bf:0xalb03b9db864d02b!8m2!3d60.472024!4d8.468946?hl=en. 
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countermeasures and preparations to better deter and adapt for future operations if 
necessary. 

This thesis acknowledges that Russia’s tactics have evolved to help that state 
achieve its strategic objectives, and seeks to analyze the consequences Norway’s special 
operations forces (NORSOF) face on the tactical level. This study deems it unlikely that 
Russia is preparing for a conventional direct attack on Norway that would spark serious 
consequences from the North Atlantic Treaty Organization (NATO). Nevertheless, as 
recent history shows, Russia has the will and capability to expand and grow farther than its 
current borders. Massive Russian investment and development in the Arctic region signal 
Norway should beware its Eastern neighbor and learn to recognize and respond to modern 
Russian power projection that could escalate into a crisis between the two neighbors. 

A. PURPOSE AND METHODOLOGY 

Ultimately, based on the assumption that hybrid threats challenge Norway’s 
security organization and Norway’s national countermeasures to hybrid threats benefit 
from NORSOF influence, this thesis’s purpose is to explore how NORSOF can improve 
its current national effort against Russian hybrid threats. To reach its goal, the thesis applies 
measures of design thinking to present operational options for NORSOF through a 
qualitative approach. Figure 2 illustrates how the thesis progresses through five distinct 
steps to reach its desired end-state. For the reader’s guidance, Figure 2 reappears 
throughout the thesis, highlighting the coming section to make clear which step the thesis 
addresses next. 


3 



Understand the 
challenges of hybrid 
threats and warfare 


Analyze the problem 
between Russia and 
Norway 


Describe the 
operational 
environment hybrid 
scenarios create 


Learn from allied 
efforts facing similar 
problems 


Generate options for 
NORSOF to better face 
new operational 

/ 

/ 


environment 


Figure 2. Visualizing the thesis development 


1. Research Questions 

The study intends to answer two research questions: 

• Which fundamental factors of the operational environment reflect Russia’s 
new tactics? 

• How have allied nations’ special operations forces improved their 

structure and design after identifying similar challenges in their 
operational environments? 

2. Thesis Structure 

Chapter I, “Introduction,” describes the thesis’s purpose and methodology by 
introducing the two research questions, and further elaborates the study’s significance. The 
chapter also describes the scope of the thesis. 

Chapter II provides an overview of the current situation involving Norway and 

Russia, and the relationship between the two neighbors in the Arctic region. The intent is 

to add context to enhance the reader’s understanding of the situation and visualize the 

potential problem for Norway’s security apparatus if a crisis emerges. The “Background” 

chapter is divided into eight separate sections, which consider the challenge from different 

angles. First, the literature review illustrates the complexity and ambiguity of hybrid threats 

and hybrid warfare. Following the literature review, the next section of Chapter II 
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elaborates on Russia and why hybrid activity and gray zone activity are effective for 
Russia. The thesis visualizes this effectiveness by describing recent hybrid threats and gray 
zone activity in Norway projected from Russia. Lastly, Chapter II describes Norway’s 
security apparatus, and illustrates Norway’s vulnerability related to threats addressing 
multiple sectors of the Norwegian government’s executive branch. To illustrate the 
complexity of such problems, the thesis uses scenarios from the Barents Sea in 2005 when 
two disputes developed between Norwegian authorities and Russian fishermen. In total, 
the context and understanding established in the “Background” chapter is relevant to 
establish a theoretical framework before analyzing the potential operational environment 
and threats revealed in Chapter III. 

Chapter III, “Russian Tactical Innovation in Georgia and Ukraine,” analyzes the 
potential hybrid threat Norway faces from the East. First, the chapter describes the 2008 
conflict between Russia and Georgia, and second, it describes the initial phase of Russia’s 
annexation of the Crimean Peninsula in Ukraine. The thesis then divides the combined 
lessons from the two conflicts into regional and non-regional lessons learned. By viewing 
the conflicts in this manner, the thesis aims to separate the tactical tools Russia 
synchronized in the two conflicts, which also may be effective for Russia in a conflict 
elsewhere than in former republics of the Soviet Union. When referring to lessons learned, 
this thesis focuses on tactical inputs and the short-term outcome, not the long-lasting 
impact. The tactical inputs provide the essential factors in the operational environment to 
which NORSOF must adapt to be fully effective—if NORSOF assistance is required in a 
hybrid scenario. 

Chapter IV, “New Operational Environment and Development,” provides 
organizational suggestions for NORSOF to consider to better face hybrid scenarios in the 
future. The chapter interprets the significant factors found in the analysis of the recent 
Russian conflicts, and then learns from allied special operations forces’ (SOF) 
organizational initiatives when facing similar operational challenges. This thesis examines 
measures taken by SOF from Finland, the Netherlands, and Germany, and from that 
examination, suggests how a similar Norwegian model would present, and in turn, how 
NORSOF can be more potent and resilient in a hybrid scenario. 
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Chapter V closes the thesis by synthesizing the first four chapters, and in doing so, 
presents low-cost measures that may be vital if a crisis emerges between Russia and 
Norway. This chapter also introduces suggestions for further research on hybrid challenges. 

3. Thesis Significance 

The described research questions are important to properly address the current 
challenge to Norway’s security apparatus. Only after acknowledging how the factors 
dominate the operational environment can Norway and NORSOF effectively introduce 
national countermeasures. This thesis is premised on the following definition of operational 
environment: 

The operational environment is the composite of the conditions, 
circumstances, and influences that affect the employment of capabilities and 
bear on the decisions of the commander. Understanding the operational 
environment is fundamental to identifying the conditions required to 
achieve stated objectives; avoiding the effects that may hinder mission 
accomplishment (undesired effects); and assessing the impact of friendly, 
adversary, and other actors, as well as the local populace, on the 
commander’s concept of operations (CONOPS) and progress toward 
attaining the military end state. 6 

While a fully operational environment analysis is not possible without a stated 
mission, the thesis aims to demonstrate the pivotal characteristics of hybrid scenarios’ 
operational environment. 

Naturally, precise predictions of the future are infeasible. Nevertheless, by 
analyzing recent Russian involvements, an analysis reveals trends in modern warfare 
currently represented in Russian power projection. The conflicts involving Russia over the 
last decade are not geographically and situationally similar to Norway’s position, and can 
most likely not be used as a learning manual for Norway. While not mirroring each conflict, 
however, Norway should learn from the trends and different tools Russia combined to 
create an effect, especially the tools seen synchronized multiple times. This analysis will, 


6 Joint Chiefs of Staff, Joint Intelligence Preparation of the Operational Environment, JP 2-01.3 , JP 
(Washington, DC: Joint Chiefs of Staff, 2009), xi, https://www.bits.de/NRANEU/others/jp-doctrine/ 
jp2_01_3%2809%29.pdf. 
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at a minimum, give Norway indicators of how Russia may project its power in a potential 
crisis between Norway and Russia. 

Conversely, if it does not address changes in the operational environment, Norway 
may face an unwanted crisis with its neighbor based on conventional countermeasures, and 
thus, Norway may not understand the current battlefield well enough to react appropriately. 
As described by Norway’s national joint doctrine, “the challenge is to recognize the unique 
factors in a specific conflict and further aim to reduce the factors affecting own forces in a 
negative manner.” 7 Consequently, equipped with an appreciation of the operational 
environment, NORSOF can visualize the nature of the underlying problem in Russia’s 
power projection. By defining the major changes in the new operational environment, one 
may prepare and organize accurately. 

By identifying the fundamental factors of Russia’s current tactics, the second 
research question addresses how to form appropriate countermeasures. The thesis proceeds 
under the assumption that the single factors defining the operational environment 
established by hybrid warfare are not new. Allied nations’ special operations forces have 
faced similar challenges in operations and situations similar to each factor. The second 
research question framing this study states that Norway can learn from the measures allied 
nations undertook to better face their challenges. By doing so, this thesis seeks to bridge 
NORSOF’s current disposition and resilience towards modern Russian threats. NORSOF’s 
resilience in a conflict, including against advanced Russian tactics, will be defined by 
NORSOF’s ability to modify and tune its forces and power to deter the Russian tactics. By 
studying allied actions to develop and increase operational output, NORSOF may leam and 
build stronger remedies to mitigate the new challenge. 

4. Thesis Findings 

This thesis addresses Russia as the current primary driver and developer of the 
hybrid approach to power projection. Russia aims to return as a great power and the 


7 Forsvarsstaben, Forsvarets Fellesoperative Doktrine [The Armed Forces Joint Doctrine] (Oslo, 
Norway: Forsvarsstaben, 2014), 18, https://fhs.brage.unit.no/fhs-xmlui/bitstream/handle/11250/224031/ 
FFOD%202014.pdf?sequence=5&isAllowed=y. 
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Kremlin thinks the North Atlantic Treaty Organization (NATO) and the West hinder 
Russia’s advancement through the West’s expansion eastward. Using this logic, and by 
adding Russia’s fear and respect for the power of NATO, this study considers Russia’s 
means as innovative as it has found a loophole in NATO’s preventive system in its Article 
V. Thus, Norway’s countermeasures to hybrid attacks must primarily be organized through 
national initiatives. The background research suggests NORSOF as Norway’s most 
appropriate military tool to counter the initial part of a hybrid crisis with Russia due to 
NORSOF’s training level, readiness, and experience from working with multi-cultural 
organizations in politically sensitive situations. 

For the purpose of this thesis, the war with Georgia had two consequences for 
Russia: a massive reorganization of Russian military and power projection, and the 
implementation of cyber operations in modern warfare. The annexation of Crimea revealed 
the “new” Russia, enabling multiple domains in an innovative tactical approach. Three 
factors stand out describing the operational environment. First, hybrid threats seek 
intentionally to be cross-sectoral to create confusion and situational complexity for the 
guarding nation. Russia may use proxy forces—or unmarked soldiers—to maintain 
plausible deniability, and to present as a civil problem. Thus, the threat remains a police 
matter and thereby does not authorize a military response. Second, Russia then exploits the 
ensuing hesitation and confusion to facilitate its next phase in the engagement. The third 
factor is the situational complexity Russia can produce by dominating the communications 
domain, both through public disinformation and by blocking its adversaries’ chain of 
command’s communication. In total, these three factors define the operational environment 
and dictate cross-sectoral partnership among security forces to respond appropriately, the 
impetus for a rapid national response to halt Russian advancement, and a robust 
counterforce capable of performing autonomously if its communications abilities have 
been compromised. 

NORSOF may leam particularly from SOF developments made in Finland, the 
Netherlands, and Germany to improve NORSOF readiness and the ability to counter 
potential Russian aggression in the future. First, NORSOF must engage in trust-building 
interdepartmental relations, suggested through the medium of a liaison element. The liaison 
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element’s mission involves local authorities’ engagement, aiming to break down cross- 
sectoral biases and organizational misunderstandings among NORSOF’s possible partners 
in a hybrid scenario. A liaison element must include tactical expertise able to demonstrate 
NORSOF’s capabilities and how NORSOF may enhance a local police district’s hybrid 
counterforce. A successful liaison element will improve a cross-sectoral partnership and 
thereby lessen the bar for interdepartmental communication, hence, lowering the reaction 
time during crisis. Second, NORSOF must establish a generic concept of operations 
(CONOPS) for hybrid scenarios. This CONOPS includes the legal framework for a 
NORSOF employment in support of a local chief of police (CoP), along with capacity- 
clarifying descriptions. The CONOPS is to support both NORSOF ground force elements 
as well as local civilian leadership during a crisis. Lastly, the thesis suggests an 
enhancement of NORSOF’s ground force facilities and capabilities to command and 
control in a highly complex situation. In total, these described initiatives will augment 
NORSOF’s standing when deployed into an operational environment as described, and 
further support and enable a CoP’s local power to halt Russian hybrid engagements. 

5. Central Terminology and Concepts 

This study explores the security situation in Norway. When referring to Norway’s 
means of control and power, the term security apparatus sums up the countermeasures 
taken, including both police and military efforts, or other means Norway may introduce to 
preserve security of the state and security of its society. If either gets challenged, this paper 
refers to that condition as a national crisis. A crisis may be defined as “an undesirable 
situation with a high degree of uncertainty and potentially unacceptable consequences for 
the individuals, organizations or states affected,” 8 and “security policy crises that deal with 


8 Det Kongelige Justis og Beredskapsdepartmentet, Meld. St. 10 (2016-2017) Risiko i et Trygt 
Samfunn- Samfunnssikkerhet [Risk in a Safe Society - Security of the Society] (Oslo, Norway: The Royal 
Ministry of Justice and Public Security, 2016), 26, https://www.regjeringen.no/contentassets/ 
00765f92310a433b8a7fc0d49187476f/no/pdfs/stm201620170010000dddpdfs.pdf. 
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situations where Norwegian sovereignty, freedom of action and vital interests are 
challenged by other states or through a severe terrorist attack.” 9 

The general term for Russia’s modem warfare is hybrid warfare or hybrid threats. 
This thesis’s background study introduces some various definitions and the debate over the 
terms; however, in general, the paper refers to Russia’s current method of power projection 
as hybrid, and use the phrase “hybrid scenario” when discussing the potential Russian 
engagement towards Norway’s interests, combining means other than strict military efforts 
to reach its strategic objective. As the thesis does not find a war between Russia and 
Norway likely, the thesis instead refers to gray zone conflicts. The gray zone may be 
defined as “the conceptual phase between diplomacy and war.” 10 

6. Thesis Scope 

This thesis addresses why cross-sectoral threats are effective towards democracies 
such as Norway, and further suggests solutions combining the police and the military sector 
in Norway. In general, cross-sectoral combinations and partnerships, as such, are debated 
and disagreed upon, usually in the civil and ethical domains. The debates are clearly 
necessary and vital; however, they are not discussed further in this study. 

The NORSOF mission portfolio ties to special reconnaissance (SR), direct action 
(DA), and military assistance (MA). 11 This study examines the operational environment 
and how NORSOF may contribute and perform successfully in Norway’s national 
countermeasures in regard to the described mission set. The thesis, however, does not 
discuss the different types of missions in any further detail. 


9 Tore Svendsen, “Forsvarets Rolle Ved Sikkerhetspolitiske Kriser i Nordomradene [The Armed 
Forces’ Role During Security Policy Crisis in the Fligh North]” (Oslo, Norway: Forsvarets Stabsskole, 
2009), 17, https://fhs.brage.unit.n 0 /fhs-xmlui/bitstream/handle/l 1250/99976/ 
Svendsen%20Tore.pdf?sequence=l&isAllowed=y. 

10 Frank Brundtland Steder, “Introduction: The Theory, History, and Current State of Hybrid 
Warfare,” CTX Special Edition 6, no. 4 (2016): 48. 

11 Forsvarsstaben, Forsvarets fellesoperative doktrine 2019 [The Armed Forces Joint Operative 
Doctrine 2019] (Oslo, Norway: Forsvarsstaben, 2019), 134, https://fhs.brage.unit.no/fhs-xmlui/bitstream/ 
handle/11250/2631948/FFOD%202019%20.pdf?sequence=l&isAllowed=y. 
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II. BACKGROUND 


Nine-tenths of tactics are certain, and taught in books, but the irrational 
tenth is like the kingfisher flashing across the pool, and that is the test of 
generals. 

—T.E. Lawrence 12 

A. INTRODUCTION 

NATO struggles to counter the hybrid threats from the East. This background study 
addresses Russia as the current number one driver of hybrid threats against the West, and 
by looking at recent power projections from Russia, this chapter explains how and why 
Russia employs hybrid threats as its strategy of choice against its adversaries. The 
background study argues that as long as NATO nations do not adequately counter hybrid 
threats at a national level, Russia will continue to target NATO members as a testing ground 
for its hybrid weapons, as well as to erode the integrity and trust internally in NATO. This 
section has three objectives: first, explain the problem with Russian hybrid threats and 
warfare; secondly, explain the situation between Russia and Norway in the Arctic region; 
and lastly, explain Norway’s security model’s vulnerability to hybrid threats and options 
for responding to hybrid attacks. As depicted by Figure 3, the first section of this thesis 
aims to explain the problem of hybrid threats and hybrid warfare. 


12 T. E. Lawrence, “The Evolution of a Revolt,” Army Quarterly and Defence Journal 1 (October 
1920): 9. 
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Figure 3. First part of thesis objective 


Initially, this section describes the West’s problem with hybrid threats and warfare. 
The section addresses the current conflictual problem for Western countries and clarifies 
the current situation by analyzing how hybrid threats are distinguished from hybrid warfare 
as the latter relies on a mixture of conventional and non-conventional means, and includes 
the deployment of soldiers, and thereby is a matter of territory. This thesis separates hybrid 
threats from hybrid warfare as hybrid warfare comprises the employment of soldiers and 
is thus a step further on the scale of intensity of power projection between two adversaries. 
Hybrid threats seek to win-over one’s adversaries by destabilizing nations from within by 
attacking national and governmental integrity and society as a whole, normally without the 
deployment of boots on the ground, 13 while hybrid warfare escalates the situation by 
including ground forces. The literature review explains how hybrid threats and hybrid 
warfare interfere with society as a whole both by attacking multiple sectors and different 
levels in targeted societies. With their non-linear approach, hybrid attacks present a 
problem for NATO allies since the attacks occur hidden and do not challenge NATO’s 
Article V. Currently, hybrid counterforces do not exist. According to this thesis, special 
operations forces (SOF) are the force of choice to counter hybrid attacks, and are best 
utilized in the gray zone when hybrid threats evolve and progress to hybrid warfare. 


13 Interview with Mark Galeotti, “Russia’s Hybrid War against the West,” 5:00, accessed March 4, 
2019, https://podcasts.apple.com/us/podcast/war-college/idl023774600?i=1000380632018. 
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In the sections examining the situation between Russia and Norway, the thesis 
illuminates Putin’s heightened focus on the Arctic region. Two significant strategic Arctic 
variables for Russia are highlighted: the positioning of most of Russia’s nuclear 
capabilities, and access to massive supplies of natural gas and oil. The West’s presence in 
the North Atlantic and the Arctic, represented in this thesis by Norway, is a potential threat 
to Russia, which seeks to control this area. Finally, this chapter describes Norway’s armed 
forces’ structure for countering hybrid warfare and concludes that NORSOF is Norway’s 
best option if employing ground forces to counter hybrid threats or hybrid warfare. 

B. LITERATURE REVIEW: THE HYBRID NATURE OF CONFLICT 

Since the new millennia, hybrid warfare is the preferred approach in several 
conflicts. Scholars from the West assert that Russia’s strategy of choice in Georgia, 
Estonia, and Ukraine gives us ample evidence that Russia’s doctrine and conceptual 
development are hybrid. 14 During these conflicts, Russia shattered the traditional thinking 
of warfare by using multiple instruments of power along with conventional forces, and 
blurred the lines between combatants and civilians by avoiding its warfighters being 
identified as Russian soldiers. Instead of targeting the its adversary’s conventional military 
forces, the Russian effort targeted the integrity of the government and tried to divide and 
isolate the population of its adversary (see Figure 4). 


I 4 Keir Giles, “The Next Phase of Russian Information Warfare” (Latvia: NATO Strategic 
Communication Centre of Excellence, May 2016); Marie Baezner, “Cyber and Information Warfare in the 
Ukrainian Conflict” (ETH Zurich, 2018), https://doi.org/10.3929/ethz-b-000321570; Brandon Valeriano, 
Benjamin Jensen, and Ryan C. Maness, Cyber Strategy: The Evolving Character of Power and Coercion 
(New York, NY: Oxford University Press, 2018), chapter 6. 
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Figure 4. Hybrid warfare’s synchronized multiple domain efforts 15 


To rebuff Western criticism, Russia points at Operation Desert Storm, Operation 
Iraqi Freedom, and interventions in Libya and argues that the West has been “blurring the 
lines between the states of war and peace for decades,” 16 and Russia needs to adapt and 
evolve to face the Western threat. General Valery Vasilyevich Gerasimov, the Chief of the 
General Staff and the Armed Forces in Russia, stated in 2013 that: 

The very rules of war have changed. The role of nonmilitary means of 
achieving political goals has grown, and in many cases, they have exceeded 
the power of force of weapons in their effectiveness. The focus of applied 
methods of conflict has altered in the direction of the broad use of political, 
economic, informational, humanitarian, and other nonmilitary measures— 
applied in coordination with the protest potential of the population. 17 


15 Source: Forsvarsdepartementet, NOU 2016:19 Samhandling for sikkerhet — Beskyttelse av 
grunnleggende samfunnsflinksjoner i en omskiftelig tid [Collaboration for Security - Protecting the Basic 
Functions of the Society in a Changing Time] (Oslo, Norway: Forsvarsdepartementet, 2016), 55, 
https://www.regjeringen.no/no/dokumenter/nou-2016-19/id2515424/. 

16 Valery Gerasimov, “The Value of Science Is in the Foresight, New Challenges Demand Rethinking 
the Forms and Methods of Carrying out Combat Operations,” Military Review, origin: Military-Industrial 
Kurier, February 27, 2013, 24. 

17 Gerasimov, 24-25. 
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One initiative to counter the threats from hybrid warfare is the U.S.-led 
“Multinational Capability Development Campaign” (MCDC), one of many initiatives 
supported by NATO to address the hybrid problem. According to the MCDC: 

Hybrid warfare is the synchronized use of multiple instruments of power 
tailored to specific vulnerabilities across the full spectrum of societal 
functions to achieve synergistic effects. The challenge presented by 
revisionist actors who exploit hybrid warfare has a broad impact across 
societies, national government and multinational institutions. 18 

MCDC’s definition is from 2019 and shows that the concept of and understanding 
of hybrid warfare are developing from prior definitions, which often referred to the 
merging and usage of both unconventional and conventional forces in a conflict. Instead, 
the current definition includes key phrases as multiple instruments, specific vulnerabilities, 
full-spectrum, and synergistic effects. To use multiple instruments and address an 
adversary’s vulnerabilities is nothing new, and aligns with B.H. Liddell Hart’s 
characterization of grand strategy: “the role of grand strategy is to coordinate and direct all 
the resources of a nation, or band of nations, towards the attainment of the political object 
of the war.” 19 What is new and innovates the concept of hybrid warfare, however, is the 
speed and accuracy in the synchronization enabled through modern technology and cyber 
capabilities as well as willingness to use this type of warfare on the civilian population. As 
visualized by Figure 4, before an attacked nation understands the scope of the threats, it 
becomes too late for proper countermeasures and leaves the nation in a fait accompli. 20 As 
Western civilization and societies become increasingly more connected and interdependent 
on the internet and media, parallels of vulnerabilities and dangers evolve and progress. 


18 Sean Monaghan, Patrick J. Cullen, and Njord Wegge, MCDC Countering Hybrid Warfare Project: 
Countering Hybrid Warfare (London, UK: Multinational Capability Development Campaign (MCDC), 
2019), 3, https://assets.publishing.service.gov.uk/govemment/uploads/system/uploads/attachment_data/file/ 
784299/concepts_mcdc_countering_hybrid_warfare.pdf. 

19 B. H. Liddell Hart, Strategy: Second Revised Edition, 2nd Revised ed. edition (New York, NY: 
Plume, 1991), 322. 

20 Edward Lucas et al., “Central European Security After Crimea: The Case for Strengthening 
NATO’s Eastern Defenses” (Washington, DC: Center for European Policy Analysis, March 25, 2014), 1, 
https://cepa.ecms.pl/sites/default/files/ 

The%20Case%20for%20Strengthening%20NATOs%20Eastern%20Defenses-%20%282%29.pdf. 
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The speed and intensity of hybrid warfare enabled through modern technology, 
along with proxy non-state actors, gives the concept an edge modern democracies tend to 
struggle with. Historically, war is often a fight over territory and geographical sovereignty; 
however, with the development of digital technology and cyber capabilities, the physical 
territory is no longer the only frontier. 21 As one aggressor can currently influence or 
interfere with the local situation anywhere, technological advancement and modern 
development are decreasing national security. Open democracies are especially more 
exposed and vulnerable, as more authoritarian regimes usually control their population 
through strict control over media and the internet. To summarize, Espen Berg-Knutsen 
states rather effectively the problem of hybridity as “a hyped term with no agreed-upon 
definition,” which “describes the increasingly blurred distinctions between war and peace, 
the military and civilian sectors, and state and non-state actors.” 22 

As hybrid warfare has been the preferred approach in several conflicts throughout 
the new millennium, hybrid threats are the current major security challenge for members 
of NATO. In 2015, the General Secretary of NATO Jens Stoltenberg stated: “Hybrid is the 
dark reflection of our comprehensive approach. We use a combination of military and non¬ 
military means to stabilize countries. Others use it to destabilize them.” 23 Hybrid threats 
diverge from hybrid warfare as they are not a preparation of the battlefield or awaiting an 
invasion, but rather aspire to destroy the integrity of a nation’s government, without the 
deployment of military forces. 24 In other words, hybrid warfare eventually concerns 
territory, while hybrid threats engage the political environment through the population (see 
Figure 6). 


21 Gregory F Treverton et al., “Addressing Hybrid Threats” (Sweden: Swedish Defence University, 
Centerfor Assymetric Threats Studies, Hybrid COE, 2018), 2, https://www.hybridcoe.fi/wp-content/ 
uploads/2018/05/Treverton-AddressingHybridThreats.pdf. 

22 Espen Berg-Knutsen, “From Tactical Champions to Grand Strategy Enablers: The Future of Small- 
Nation SOF in Counter-Hybrid Warfare,” CTX Special Edition 6, no. 4 (November 2016): 61. 

23 Jens Stoltenberg, “Keynote Speech by NATO Secretary General Jens Stoltenberg at the Opening of 
the NATO Transformation Seminar,” NATO, 2015, http://www.nato.int/cps/en/natohq/ 
opinions_118435.htm. 

24 Interview with Mark Galeotti, “Russia’s Hybrid War against the West,” 16:00. 
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Hybrid threats usually address vulnerabilities within structures of political, 
military, economic, social, infrastructure, and information (PMESII) levels and 
organizations, and they generally deploy through a broad range of instruments. 25 The goal 
of hybrid threats is to pursue national interests and objectives in foreign nations without 
using military combatants, but instead target the adversary’s society. 26 The broad range of 
effects through multiple channels creates a larger space to do harm and implements tools 
to an adversary with plausible deniability, disguising the threats as singular actions that do 
not appear connected due to the synchronized use of multiple instruments. Figure 5 
presents a simplified model to visualize the scope of hybrid tactics and how a state’s 
projected synchronized efforts may remain in the gray zone and not escalate into a military 
conflict. 



Figure 5. Hybrid warfare’s aim to remain below the threshold of war 


To limit the risk of escalation and military responses, a central side of hybrid threats 
is to remain below the threshold of acts of war with the intent to bring down one’s adversary 


25 Monaghan, Cullen, and Wegge, MCDC Countering Hybrid Warfare Project: Countering Hybrid 
Warfare, 13. 

26 Treverton et al., “Addressing Hybrid Threats,” 3, 10. 
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with a thousand cuts rather than a single stab. To stay below the threshold of war, hybrid 
threats are often deployed through proxy forces to maintain plausible deniability, 27 as the 
truth loses value by becoming what one can make the population believe. 28 Individual 
hackers with political support, motorcycle clubs such as the Night Wolves funded by 
Vladimir Putin, and paintball clubs in Estonia training ethnic Russians in tactics, and 
soldiers in unmarked uniforms are all examples of how hybrid threats project at PMESII 
vulnerabilities. 29 Furthermore, these power projections are showing how state-driven 
actions involve civilians from the projecting side of hybrid threats. The usage of civilians 
and non-state organizations to project synchronized state-desired effects toward another 
nation creates a question of responsibility and retaliation. The attacked country will remain 
with an unanswered question, asking who should it retaliate against? Which international 
and national laws apply? 

While scholars debate about the definition of hybrid warfare, strategists debate on 
how to counter the hybrid challenge efficiently. As this study so far has identified a broad 
range of instruments for attacking vulnerabilities in PMESII, a natural consequence is 
multiple countermeasures centrally orchestrated. Hybrid threats are generally inexpensive, 
and since they remain below the threshold of war, they weaken and reduce the superior 
advantage stronger nations and alliances have through military and economic dominance. 
The tendency to inflict adversaries harm disproportionate to acts of war currently creates a 


27 Christopher Chivvis, Understanding Russian “Hybrid Warfare And What Can Be Done About It 
(Santa Monica, CA: RAND Corporation, 2017), 2-3, https://doi.org/10.7249/CT468; Valeriano, Jensen, 
and Maness, Cyber Strategy, 115-17. 

28 Lionel Beehner et al., “Analyzing the Russian Way of War” (New York: Modern War Institute at 
West Point, March 2018), 5, https://mwi.usma.edu/wp-content/uploads/2018/03/Analyzing-the-Russian- 
Way-of-W ar.pdf. 

29 Tim Maurer, Cyber Mercenaries: The State, Hackers, and Power (Cambridge New York, NY Port 
Melbourne New Delhi Singapore: Cambridge University Press, 2018), 31-32; “The Night Wolves, Putin’s 
Biker Gang,” The Economist, August 23, 2018, https://www.economist.com/europe/2018/08/23/the-night- 
wolves-putins-biker-gang; https://www.facebook.com/anneapplebaumwp, “Opinion I Russia Finds Young 
Men Who Love Guns — and Grooms Them,” Washington Post, accessed May 12, 2019, 
https://www.washingtonpost.com/opinions/global-opinions/russia-finds-young-men-who-love-guns—and- 
grooms-them/2018/01/18/0090fbb2-fbdl-l Ie7-a46b-a3614530bd87_story.html; Michael Carpenter, 
“Russia Is Co-Opting Angry Young Men,” The Atlantic, August 29, 2018, https://www.theatlantic.com/ 
ideas/archive/2018/08/mssia-is-co-opting-angry-young-men/568741/. 
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reprisal-vacuum for a collective NATO response. 30 Hybrid threats smartly outmaneuver 
NATO’s undoubted powers and superiorities and thereby contribute to destroying both 
NATO’s and a targeted government’s integrity. NATO’s strength and superiority have thus 
created its counterweight: 

Our conventional superiority creates a compelling logic for states and non¬ 
state actors to move out of the traditional mode of war and seek some niche 
capability or some unexpected combination of technologies and tactics to 
gain an advantage. 31 

For NATO allies, this makes hybrid threats, first of all, a matter of national concern. 
Besides, as hybrid threats do not recognize boundaries between civilian and combatant, nor 
covert and overt operations, and no declaration of war or settling peace, 32 these threats 
include more than a nation’s military as its countermeasure and become more significant 
than a military defense problem. As the threats appear non-military, they become a civil 
problem. Frank Hoffman, one of the first scholars introducing the term “hybrid,” explained 
that this becomes an ambiguous problem for the conventional military thinker, as he stated 
that increasingly perplexity and irregularity challenges the conventional military 
thinking. 33 Thus, the national instruments of power other than military; political, 
economic, civil, and informational (MPECI) should be included to fight hybrid threats in a 
whole of government approach. 34 To counter hybrid threats, a nation needs to chain its 
resources in its security apparatus, across all governmental agencies. 35 

While not doctrinally described as a hybrid countermeasure, SOF stand out as the 
force of choice in parts of the hybrid challenge, not just as a military force, but also as an 


30 Mark Galeotti, Hybrid War or Gibridnaya Voina? Getting Russia’s Non-Linear Military Challenge 
Right (Morrisville, NC: LULU Press, 2016), 9. 

31 James N. Mattis and Frank Hoffman, “Future Warfare: The Rise of Hybrid Wars,” U.S. Naval 
Institute 132, no. 11 (November 2005): 2. 

32 Galeotti, Hybrid War or Gibridnaya Voina?, 7. 

33 Frank G. Hoffman, Conflict in the 21st Century: The Rise of Hybrid Wars (Arlington, VA: Potomac 
Institute for Policy Studies, December 2007), 8-9. 

34 Monaghan, Cullen, and Wegge, “MCDC Countering Hybrid Warfare Project: Countering Hybrid 
Warfare,” 13-14. 

35 Berg-Knutsen, “From Tactical Champions to Grand Strategy Enablers: The Future of Small-Nation 
SOF in Counter-Hybrid Warfare,” 64. 
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enabler of capacities to local authorities, and, because of SOF’s nature working through, 
by, and with partnering organizations, SOF functioning “as a bridge between the military 
and other agencies.” 36 More specifically, SOF could leverage national efforts in gray zone 
operations between hybrid threats and hybrid warfare, as illustrated in Figure 6. 
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Figure 6. Flybrid threats and hybrid warfare shown on a continuum 37 


Gray zone operations—operations in a conceptual space between war and 
peace—represent areas of political sensitivity within the range of military operations 
(ROMO). 38 As the global defense competition currently changes the way of international 
conflict, the ability to operate and affect the gray zone situation is becoming increasingly 
more important. “Special operations (SO) enables options in politically sensitive situations, 
and are trained and prepared to achieve both military, diplomatic, informational or 


36 Berg-Knutsen, 64; Anna Simons, “SOF 2030: An NPS Defense Analysis Seminar Report” 
(Monterey, CA: Naval Postgraduate School, 2012). 

37 Source: Sean Monaghan, “Countering Hybrid Warfare: Conceptual Foundations and Implications 
for Defence Forces,” Information Note (Multinational Capability Development Campaign (MCDC), March 
2019), 4, https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/ 
840513/20190401 -MCDC_CHW_Information_note_-_Conceptual_Foundations .pdf. 

38 Steder, “Introduction: The Theory, History, and Current State of Hybrid Warfare,” 14. 
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economic objectives,” and are therefore relevant across ROMO, also in the gray zone. 39 In 
1999, John M. Collins stated that: 

Special Operations Forces (SOF) help shape the international security 
environment, prepare for an uncertain future, and respond with precision in 
a range of potential crises. Unique training and skills enable them to operate 
in situations where conventional units cannot be used for political or 
military reasons. Moreover, they place a priority on applying finesse rather 
than brute force and possess overt, covert, and clandestine capabilities not 
found elsewhere within the Armed Forces. 40 

Collins describes SOF as the force of choice in the international security 
environment where a political crisis demands discreet or hidden interventions. By 
analyzing the Allied Joint Doctrine for special operations, AJP-3.5, NATO special 
operations are designed to “achieve political, military, informational, and economic 
objectives,” through “nonconventional operational skills applied with adaptability, 
improvisation, innovation, and self-reliance.” 41 The doctrine further describes common 
central attributes for SOF as tempo, pre-emption, and disruption, which label SOF’s ability 
to rapidly stop or hinder an adversary’s competence or strength to reach its objectives. 

Another suitable SOF attribute in gray zone operations countering hybrid threats or 
warfare is described through AJP 3-5 as “politico-military considerations” that “require 
clandestine or discreet techniques” or performance. 42 Gray zone operations are by their 
nature politically sensitive and may require a low-profile approach (see Figure 6). Because 
special operations are often politically sensitive, avoiding detection is one of the factors for 
mission success. The necessity of operating discretely fosters employment and training in 
intricate methods of insertion and maneuver to successfully “penetrate and return” 
undetected in complex operations. 43 Besides, hybrid threats are multi-sectoral, which 

39 Joint Special Operations University, Special Operations Forces Reference Manual: 4th Edition 
2015 (MacDill Air Force Base, FL: The JSOU Press, 2016), 1-2. 

40 John M. Collins, “Special Operations Forces in Peacetime,” Joint Force Quarterly , Spring 1999, 

56. 

41 North Atlantic Treaty Organization, AJP-3.5 - Allied Joint Doctrine for Special Operations - NATO 
UNCLASSIFIED , AJP (Brussels, Belgium: NATO Standardization Office, 2009), 1-1, 1-2. 

42 North Atlantic Treaty Organization, LEX-5. 

43 Joint Special Operations University, Special Operations Forces Reference Manual, 1-1. 
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generates Clausewitzian friction; thus, SOF’s flexibility and creativity enable 
independence and a broader range of capabilities than conventional military units can offer 
to meet such threats. 44 SOF are small units that are taught to work by and with other 
agencies and organizations, and thereby share an integrated understanding of cross-sectoral 
cooperation and partnership better than most. 45 Consequently, “in a pre-Article V scenario, 
the likely best national and international strategy and resource to counter hybrid forces is 
to use SOF not by themselves, but in combination with diplomatic tools and conventional 
resources.” 46 

C. RUSSIA 

There are no morals in politics; there is only expedience. A scoundrel may 
be of use to us just because he is a scoundrel. 

—Vladimir Lenin 

To further explain the current situation in the Arctic region, the next five sections 
elaborate on Russia’s and Norway’s current situation, and analyze the situation between 
the two neighbors (visualized by Figure 7). This section, Russia, explains Russia’s recent 
development and clarifies why the Arctic region is of upmost importance to Russia. 


44 Robert G. Spulak, “A Theory of Special Operations,” JSOU Report 07-7, October 2007, 17-21. 
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46 Steder, “Introduction: The Theory, History, and Current State of Hybrid Warfare,” 13. 
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Figure 7. Analyzing the current status 

Vladimir Putin is determined to stabilize Russia as a great power again. Even back 
in 1999, when Putin was appointed prime minister, he clearly stated that “Russia has been 
a great power for centuries, and remains so.” 47 In his speech before the Duma, he further 
spoke about Russian territorial integrity, interests abroad, and domestic reform. His speech 
turned out to be blueprints for the next 20 years in his path to repair Russia’s global 
standing. Through the years with Putin as president, Russia has lost its interest in 
cooperation and integration with Western institutions and taken a more opposing role 
against NATO and the European Union (EU), as Russia believes that both institutions pose 
significant threats to Russian interests. 48 From 1999 to 2016, Russia annually increased its 
military funding, increased its spending on development and modernization of its military 


47 Oliver Bullough, “Vladimir Putin: The Rebuilding of ‘Soviet' Russia,” BBC News, March 28, 
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Kirchick, “Russia’s Plot against the West,” POLITICO, March 17, 2017, https://www.politico.eu/article/ 
russia-plot-against-the-west-vladimir-putin-donald-trump-europe/. 
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forces, and shifted focus from the Cold War-era dependence on large, heavy equipment to 
smaller mobile units. 49 


Portions of Russian military expenditures are classified, and thereby obscure the 
total picture of the Russian security sector’s development. The Russian security sector is 
also funded through the federal budget, and 25 percent of the federal budget is classified 
as secret. 50 As major parts of the classified budget are related to the defense-industrial 
progress, and therefore not counted in the official numbers, the Russian defense budget 
does not provide the entire description of the situation. Thus, along with Russia’s 
increasing usage of private military forces, the extent of Russia’s military investments is 
not as transparent as the West desires. Costly military operations in Syria and Ukraine, 
along with recent massive exercises in the Arctic region and the Russian western border, 
imply that Russia is not scaling down its military expenditures. While NATO’s members 
are arguing over whether to invest more of each nation’s gross domestic product (GDP) 
into the joint defense structure, Russia is downplaying its military investment by making 
official statements that its investments are at 4 percent of the GDP while the accurate 
number is closer to 6 percent. 51 By stating a lower amount, Russia is trying to influence 
the NATO members’ enthusiasm to increase the NATO budget to the mandated percentage 
of GDP for each member. Nonetheless, the current results do not match their ambitions. 
The modernization process of the Russian armed forces is far from finished, and the process 
is currently under increasing economic pressure. 5 - Because of a stagnating economy, in 
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2018, Russia needed to cut its defense budget for the first time since 2006 and thereby is 
no longer among the top five countries in the world in terms of military budgets. 53 

One reason for the current Russian development and rearmament is that Russia 
sincerely believes it is under political attack from the West, and to keep national 
sovereignty and cultural integrity, Russia needs to defend itself from the threat from the 
West. During Russia’s annual Victory Day parade on May 9, 2019, Putin spoke to the 
public, warning them about the increasing security threat and stated that “Collective 
resistance to the bearers of deadly ideas is crucial once again.” 54 

Furthermore, Putin has addressed this threat assessment for several years, and it 
served as a motive for the annexation of Crimea: 

Let me note too that we have already heard declarations from Kiev about 
Ukraine soon joining NATO. What would this have meant for Crimea and 
Sevastopol in the future? It would have meant that NATO’s navy would be 
right there in this city of Russia’s military glory, and this would create not 
an illusory but a perfectly real threat to the whole of southern Russia. 55 

To protect its interests and pursue the desire of global dominance, Russia is bound 
to answer what it perceives to be the constant threat from the West, and because of the 
current economic and military ratio between Russia and NATO, hybrid threats are an ideal 
strategy for Russia to advance. 56 While the West believes and accuses Russia of 
developing and deploying hybrid threats towards NATO and former members of the Soviet 
Union, Russia alleges that hybrid warfare and hybrid threats originate from the West and, 
more specifically, the United States. In 2013, the Chief of the General Staff in Russia, 
General Valery Gerasimov, published an article explaining how the Kre ml in understood 
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the Arab Spring. Figure 8 demonstrates how Gerasimov viewed the West’s power 
projection and the significance of non-military means in modern conflict. 


Military conflict 


Direct 

military threat 
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military threat 


Potential 
military threat 




Figure 8. The role of nonmilitary methods in the resolution of 
interstate conflicts 57 


57 Source: Gerasimov, “The Value of Science Is in the Foresight, New Challenges Demand 
Rethinking the Forms and Methods of Carrying out Combat Operations,” 28. 
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In his article, Gerasimov asks whether Russia is armed and prepared for the 
Western non-linear threat and points at previous conflicts in Iraq, Libya, and Afghanistan 
to state his theory of modem warfare: 

The very “rules of war” have changed. The role of nonmilitary means of 
achieving political and strategic goals has grown, and, in many cases, they 
have exceeded the power of force of weapons in their effectiveness. The 
focus of applied methods of conflict has altered in the direction of the broad 
use of political, economic, informational, humanitarian, and other 
nonmilitary measures—applied in coordination with the protest potential of 
the population. 58 

Although the two sides of the conflict—Russia and NATO—debate which side is 
to blame for the hybrid development, it is essential to note that the two sides have different 
interpretations of what kind of development it is. 59 While NATO recognizes a new pattern 
of power projection from Russia through multiple channels and debates what kind of 
activity it is, Russia names it war and finds itself at war with the West; however, Russia 
acknowledges that war has changed in a new, modern, non-linear way. 60 From the Russian 
standpoint, as NATO compromises Russian sovereignty, the only logical next step for 
Russia is to mobilize against NATO to equalize the balance between the two powers. 
Russian generals acknowledge the merging of combat and humanitarian operations, and 
consider the operational combination of enemy-centric and population-centric as crucial 
for mission success. 61 Besides, as traditional warfare unites with asymmetrical methods, 
the Kremlin highlights the trend of modern warfare to employ military forces with plausible 
deniability, or as referred to in the Kremlin, actions lacking evidence (bezulikovye 
deistviia). 
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Regardless of the debate as to who started the hybrid development, the Gerasimov 
article was a reflection of experienced development and not the catalyst to set off the 
Russian hybrid development. The ability to bring down an enemy by utilizing irregular 
means goes back to Lenin. The Soviet Union utilized “active measures” (aktivnyye 
meropriyatiya) during the Cold War, measures ranging from propaganda to terrorism and 
assassination. 62 In 1998, General Makhmut Akhmetovich Gareev presented his ideas of 
redesigning the battlefield and established the preferred conditions to win, ranging from 
the ability to “influence the consciousness and feelings of the population,” to even more 
futuristic ideas such as creating earthquakes, tsunamis, and holes in the ozone layer in 
specific regions. 63 

These unconventional ideas of warfare and influence operations are not new 
concepts; however, Russia’s new toolbox is innovative, and its new tools increase Russia’s 
leverage. The utilization of proxy forces through a mix of state and non-state actors, and 
using organized crime as an operational capacity along with the implementation of cyber 
operations, give the Kremlin speed and a broader scope of operational potential; at the same 
time, the innovation provides Russia plausible deniability when needed to remain below 
the threshold of war. 64 Not only can Russia proceed with its goal to influence policy in 
favor of Russian enterprise, but it can also create chaos and confusion among institutions 
in the West. 65 

Russia places particular value and focus on the Arctic region, and the region stands 
as a cornerstone in Russia’s ambition to return as a significant global power for two 
reasons: First, the Arctic region holds “a considerable fraction” of petroleum reserves in 
the world, and as the ice is melting, new sea lines of communication open and facilitate 
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logistics not possible earlier. 66 The Russian economy builds on natural resources like oil 
and gas, and is the EU’s largest supplier of gas, responsible for 40 percent of the petroleum 
energy in Europe. 67 By 2020, the Russian government’s goal is to make the Russian Arctic 
gas installations the country’s leading supplier of petroleum products; hence, the region 
becomes vital in parts of the Russian strategy. 68 The massive investment and development 
in the Arctic region, along with massive investments in ice-breaking capable liquid natural 
gas (LNG) tankers, further reveals Russia’s clear Arctic strategy. 69 

Second, the Arctic Ocean is of great military strategic importance for Russia as the 
Barents Sea remains as Russia’s naval bastion and houses the Russian nuclear submarine 
fleet and its security forces. 70 The militarized Kola peninsula is one of Russia’s most 
strategically vulnerable areas, as it holds 70-80 percent of Russia’s nuclear capabilities, 
and requires Moscow to remain at its strategic defensive depth in the region. 71 The Russian 
bastion defense involves the Barents Sea, The Norwegian Sea, and parts of the northern 
territories in Norway (see Figure 9). 7 - The submarines with nuclear strike capacities are of 
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most strategical importance for Russia as means of deterrence to the West, and as a 
cornerstone in the Russian deterrence strategy, Russia depends on a robust Arctic presence 
to maintain the stated Russian ambition to secure its standing as a global power. 73 In total, 
the military capacities stationed in the Kola peninsula in Russia are of most significant 
importance to Russia, a statement underlined by the current establishment of an Arctic 
Command in Murmansk. 
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Figure 9. Russia’s Bastion Defense’s submarine operational area 74 


Russia’s integrity and resolve to project military power in the Arctic are not yet 
tested; however, in the last decade, Russia has displayed both its will and capability to 
defend its national interests in conflicts with Georgia (2008) and Ukraine (2014— 
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present). 75 Furthermore, Russia has also demonstrated its ability to deploy its power 
overseas, as with its recent involvements in Syria. 76 Nevertheless, with Russia’s massive 
Arctic coastline, along with the described economic and geostrategic variables, it is safe to 
state that the Arctic is a priority for Russia, and Russia will remain a dominant Arctic actor 
in the future. Over the last five years, Russia has increased its military activity in the Arctic 
areas, and is conducting military exercises closer to Norway than before, 77 exemplified 
during exercise Trident Juncture in Norway in 2017 (see Figure 10). During Trident 
Juncture, the largest NATO exercise since the Cold War, Russia interrupted both planned 
and announced NATO training, as well as disturbed the commercial sea-lines by 
establishing a complex military live-firing exercise close to the coastline of West Norway 
in the North Sea. The Russian exercise was unannounced until one week before the missile 
testing started. 78 This was the first time Russia has conducted live-firing exercises as far 
south in the North Sea, and as close to Norway’s coastline. The live-firing area was 
announced to be in international airspace and waters; however, it was in the same waters 
as exercise Trident Juncture operated, and it was within the area of several of Norway’s oil 
rigs. The exercise may indicate Russian will to expand its Bastion Defense from the Barents 
Sea and into the Norwegian Sea, and by that demonstrate to NATO its increased 
capability. 79 
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Figure 10. NATO’s and Russia’s area of interest during exercise 
Trident Juncture 80 

To summarize, Moscow has found an effective way to challenge its neighbors and 
adversaries in the West, and remain operationally consistent and comfortable operating in 
the gray zone “where economies are informal, local rule is subdivided, and information 
and facts are ambiguous.” 81 The consistency makes Russian hybrid aggression rational. 
Thus, the likelihood of Russia continuing its full-spectrum power projection to pressure 
Norway to comply up to the borderline of a NATO involvement in a case of conflict is 
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high, 82 and incentivizes the utilization of Norway’s special operations forces (NORSOF) 
in a broader non-traditional role in defense of the homeland. 83 

D. NORWAY’S NATIONAL SECURITY MODEL 

The Russian interests and development naturally affect Norway, and because 
Norway is a NATO member and part of the West’s sanctions on Russia, the tension 
between the two neighbors currently increases. 84 This section first discusses Norway’s 
position compared to Russia and, second, presents Norway’s national security model, 
clarifying why the model’s reliance on strict divisions between its ministries is vulnerable 
to hybrid threats. Lastly, to illustrate some of the hybrid problems Norway currently 
struggles with, this section presents some recent Russian hybrid threats projected to 
Norway to illustrate parts of the problem Norway is currently facing. While not being a 
part of NORSOF’s mission portfolio or requiring military interventions, each case provides 
details of how Russia prods for weaknesses, as well as describes some of the factors this 
thesis analyzes further in its following chapters. 

The opening of the polar ice and the potential of the natural resources in the Arctic 
area gives the nations present in the region massive opportunities and challenges. Norway 
has substantial interests in the Arctic region and depends on productive dialogue and 
diplomacy with the other countries in the region, especially Russia. 85 Despite its desire for 
diplomacy and cooperation, Norway, as a member of NATO, is part of the West’s sanctions 
on Russia as a reaction to the war in Ukraine, and thereby is in opposition to Russia. 
Norway’s exclusive economic zone in the Barents Sea contains half of Norway’s 


82 Berg-Knutsen and Roberts, Strategic Design for NORSOF 2025, 20. 

83 Steder, “Introduction: The Theory, History, and Current State of Hybrid Warfare,” 7. 

84 Ministty of Defence (of Norway), Unified Effort- Expert Commission on Norwegian Security and 
Defence Policy, 17. 

85 Ministty of Foreign Affairs (of Norway), Meld. St. 36 (2016-2017) Setting the Course for 
Norwegian Foreign and Security Policy (Oslo, Norway: Norwegian Ministty of Foreign Affairs, 2017), 14, 
https://www.regjeringen.no/contentassets/0688496c2b764f029955cc6e2f27799c/en-gb/pdfs/ 

stm201620170036000engpdfs .pdf. 


33 



undiscovered oil and gas reserves. 86 The exclusive economic zone is a geographical zone 
where “Norway does not have full sovereignty, but rather sovereign rights over natural 
resources in and on the seabed and in the waters above.” 87 As the global demands for 
energy, food, and raw materials are increasing, the Arctic areas can become an even more 
critical part of international supply and distribution: 

The High North constitutes Norway’s most important strategic area of 
responsibility. More than 80% of the country’s sea territory is located north 
of the Arctic circle. Norway has both the right and duty to preserve its 
sovereignty and its sovereign rights. 88 

These production and business opportunities make the Arctic the most important 
priority in Norway’s security policy. 89 The increased international attention to the Arctic 
region enables both opportunities and challenges for Norway. Thus, it impacts national 
security. The situation in the Arctic is currently peaceful, a situation both Norway and 
Russia are interested in maintaining. However, if the situation escalates into conflict or 
crisis because of resources or territory, a hybrid approach will most likely remain as the 
Russian choice of tactic to keep Norway’s NATO allies out of the conflict. 

The Norwegian government’s ministry structure is characterized by strict vertical 
guidelines and minimal cross-sectoral function or cooperation (see Figure ll). 90 The 
purpose of strict vertical guidelines is to maintain a clear understanding of responsibilities 
and authority among and between the ministries, and thereby decrease any process’s 
complexity and increase the effectiveness by decentralizing the authority. The features of 
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the ministries’ silo structure originate from long-standing political traditions. 91 The silo 
structure is one of the more central features of Norway’s security model and is an effective 
model in times of peace and, in theory, against conventional threats. 92 By contrast, the 
effect of hybrid threats challenges the traditional model as the threats are cross-sectoral and 
intentionally affect several ministries and departments at the same time. The lack of 
horizontal linkage and interagency between the ministries at a lower level is ineffective in 
the efforts taken to counter the hybrid threats. 
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Figure 11. Norway’s security apparatus. The model is simplified for 
visual consideration. 93 
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As visualized by Figure 5, the nature of hybrid threats is to target multiple layers 
and levels of society, but Norway has no specified organization dedicated to fighting and 
monitoring hybrid threats. Illegal actions on Norwegian soil are considered and treated as 
criminal activity, and thus investigated and prosecuted by the police sub-department or 
organization in charge of the given type of criminality. In a local incident, e.g., a terrorist 
attack, the local CoP “owns” the situation and controls the authorities’ appropriate response 
and initiative. If needed, the CoP can request support from national military forces, due to 
lack of resources or the present danger in the situation. Accordingly, the Ministry of Justice 
and Public Security (MoJPS) holds the responsibility for each singular hybrid threat. In 
extraordinary events or security crises, the MoJPS’s subunit Crisis Support Unit (KSE) 
[ Krisest0tteenheten ] is responsible for all information to the MoJPS to establish situational 
awareness for strategic management and decisions. 94 Normally, KSE reports to the Crisis 
Council [Kriseradet], the highest functional level of authority and responsibility in the 
Norwegian government regarding national security. The Crisis Council is a cross-sectoral 
organ that gathers monthly or when needed and consists of the Advisor of Ministry 
[ Departmentsrad ] from the MoJPS, the Ministry of Health and Care Services, the Ministry 
of Defense, and the Ministry of Foreign Affairs. The advisor in each Ministry is the 
administrative director of each department. The MoJPS leads the Crisis Council if nothing 
else is decided, and reports directly to the office of the Prime Minister (SMK). 

A potential national security crisis is defined as “an unwanted situation with a high 
degree of uncertainty and potentially unacceptable consequences for the individuals, 
organizations, or states involved.” 95 A security crisis threatens fundamental national 
interests and can be generated by both intentionally or unintentionally conflictual 
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escalation. 96 Characteristics are fear and chaos among the population, created by tools 
potent enough to threaten the government’s ability to secure national interests, in a 
situational blurred gray zone between peace and armed conflict. In a security crisis, the 
national and international implications are of such a level that coordination and 
management of the security crisis must be centralized at the governmental level. 97 

The explained Norwegian model illustrates some gaps that hybrid threats can 
exploit. First, the silo-based ministries and lack of cross-sectoral cooperation and 
communication create a vacuum for hybrid threats to maneuver in. By its nature, crisis 
management is a reactive response, exemplified by natural disaster mobilizing the society 
to overcome the situation; however, hybrid threats need proactive measures to understand 
that a hybrid situation is occurring, which requires an excellent situational awareness across 
all sections. 98 As hybrid threats are designed to affect multiple layers and levels of society 
(see Figure 4), several ministries can experience minor to medium incidents without 
anyone understanding the situation as a whole. The KSE is under the MoJPS and thereby 
both culturally and systemically limited to only gathering information that enters the 
MoJPS as a crime under investigation. As the distinction between peace and security crisis 
and war blurs, the singular events must be seen in a broader overview to attribute several 
incidents to one aggressor. 99 Situational awareness, as described, requires a reliable civil- 
military coordination system to address the threats appropriately. 


96 Ministry of Defense and Ministry of Justice and Public Security, St0tte og samarbeid, En 
beskrivelse av totalforsvaret i dag [Support and Cooperation, a Description of the Current Total Defense] 
(Oslo, Norway: Ministry of Defense and Ministry of Justice and Public Security, 2018), 27, 
https://www.regjeringen.no/contentassets/5a9bd774183b4d548e33dal01e7f7d43/stotte-og-samarbeid-en- 
beskrivelse-av-totalforsvaret-i-da.pdf. 

97 Ministry of Defense and Ministry of Justice and Public Security (of Norway), 27. 

98 Forsvarets Hpyskole, “Hybrid krig og hva Forsvaret bpr vaere forberedt pa [Hybrid War and What 
the Armed Forces Should be Prepared for],” Pa Krigsstien, 24:25, accessed June 24, 2019, 
https://podcasts.apple.com/us/podcast/2O-hybrid-krig-og-hva-forsvaret-b0r-vaere-forberedt-pa/ 

idl 105998430?i=1000381197913. 

99 Ministry of Defense and Ministry of Justice and Public Security (of Norway), Stptte og samarbeid, 
En beskrivelse av totalforsvaret i dag [Support and Cooperation, a Description of the Current Total 
Defense], 14. 


37 



Second, the concept of military assistance to the police and its lack of pre-decided 
regulation or rules of engagement in an operational plan in a national or regional crisis 
relies on the crisis management talent and mental capacity of the local CoP who decides 
when and if to request military assistance. In a situation where the CoP initially mistakenly 
believes the conditions to be within the police’s ability and resources, a controllable 
situation can escalate into a national security crisis threatening the state security. 100 
Furthermore, for the CoP to understand which resources and capabilities are available, 
regular training and knowledge are necessary to know what is possible. Without experience 
and understanding of the force-package available, crisis management is prone to cultural 
biases, organizational language barriers, and different operational approaches. 101 In total, 
there is footing to claim that a CoP, who knows and understands individual cases of 
criminality, can be overwhelmed in an immediate unforeseen security crisis. In such 
situations, it is reasonable to become conservative and rely on one’s level of training and 
experience. If not exposed to training and knowledge about the capabilities of the armed 
forces, it remains uncertain if the CoP will be able to alert the National Joint Headquarters 
(NJHQ) within the needed timeframe. 

Third, the lack of designated forces to address hybrid threats in the military and 
police can potentially create a vacuum of available forces if a national security crisis 
emerges, and the armed forces are fully occupied with their primary task to maintain the 
security of the state. 102 The Norwegian commander of the armed forces stated in his 2019 
New Year speech in Oslo his significant concerns about the size and operational capacities 
of the current armed forces: “today, the reality is that the minimum-defense is no longer at 
minimum. It is too small [the armed forces] to over time fulfill our commitments nationally 


100 Norheim-Martinsen et al., Det nye totalforsvciret [The New Total Defense], 1:54. 

101 Alt om samfunnssikkerhet, “Utvikler vi et Totalforsvar Tilpasset Dagens Samfunn? [Do We 
Develop a Total Defense Adjusted for Today's Society?],” Alt om samfunnssikkerhet, February 20, 2019, 
https://www.altomsamfunnssikkerhet.no/samfunnssikkerhet-og-beredskap/utvikler-vi-et-totalforsvar- 
tilpasset-dagens-samfunn/. 

102 Norheim-Martinsen et al., Det nye totalforsvaret [The New Total Defense], 1:54. 
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and internationally.” 103 With a statement as such, it becomes a gamble to give the armed 
forces a “new” secondary mission, and then rely upon it to sort out its resources in times 
of crisis. 

E. RECENT HYBRID THREATS BETWEEN RUSSIA AND NORWAY 

In recent years, Norway has been experiencing several hybrid threats from Russia, 
some of them more open and overt than others. The hybrid threats are generally of civil 
concern; however, as they present far beyond the scope of Norwegian local police’s 
common challenges or capacity, it is challenging to produce the appropriate response for 
the projected threat. 

The following three cases described in this paper exhibit activity organized from a 
central level in Russia, projected towards Norway to burden and strain Norway’s security 
systems, or to gain information about Norway’s and NATO’s activity. None of the 
described cases stands out as a military problem, nor do they represent any typical SOF 
mission. Nevertheless, as the three cases describe organized and synchronized Russian 
power projection challenging the Norwegian civilian society in multiple ways and at 
several levels, the cases stand as a proof of current hybrid threats, and at a minimum, they 
describe some of the tactical tools deployed that could be used to induce complexity to a 
later crisis situation where NORSOF are involved. 

1. Case 1 

In 2015, Europe experienced a massive immigration of refugees from North Africa. 
Norway was affected too, however, on a much smaller scale than countries in South and 
Central Europe. In August 2015, Norway’s most northern county, Finnmark, was struck by 
a wave of immigrants crossing the border from Russia; however, these immigrants had no 


103 Haakon Admiral Bruun-Hansen, “Forsvarssjefens Tale i Oslo Militaere Samfund, 22 Januar 2019 
[the Commander of the Armed Forces’ Speech in Oslo Military Society, January 22 2019]” (speech, Oslo, 
January 22, 2019), https://forsvaret.no/aktuelt_/ForsvaretDocuments/2019-01- 
22%20%28U%29%20FSJ%20tale%200MS%202019.pdf. 
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linkage to the immigrants crossing the Mediterranean Sea from North Africa. 104 The 
immigrants in Finnmark originated from several nations, among others, Pakistan, 
Afghanistan, Iraq, and some even from Russia. 105 The most common linkage between the 
immigrants was a sudden statement of deportation from Russia, some of them after several 
years in Russia. During the fall of 2015, Finnmark, a society consisting of small cities and 
peripheral habitation, received almost 6,000 immigrants. Many were afflicted with disease 
or disabilities; some women were pregnant. The Russian government controlled the traffic 
of immigrants through the Federal Security Service [Federalnaja sluzjba bezopasnosti] 
(FSB). Initially, the immigrants did not show any understanding of the process they were 
part of or what they desired. Over time, however, the immigrants gained guidelines and 
directions through social media to apply for asylum when being interviewed by the 
Norwegian government. In this way, social media was used to control and synchronize the 
immigrant’s explanations. 

The local police and government in Finnmark were overwhelmed by the massive 
influx of immigrants. The local system did not have established plans or a framework for 
the demands of medical supervision, housing, nourishment, and processing in such large 
numbers. The local authorities had no other choice than to declare the situation a crisis. 
Yet, the National Police Directorate (POD) did not respond immediately, presumably due 
to problems and centralized pressure resulting from the flow of immigrants from North 
Africa into Southern Norway. When reaching out to the media, the local authorities of 
Finnmark did not initially succeed in raising the national awareness of the move from 
Russia. When the immigrants in Finnmark were asked why they suddenly decided to go to 
Norway after living many years in Russia, the local police received a variety of 
explanations. When asked why they did not apply for asylum in Russia, most of the 
immigrants did not know that was an option. Eventually, at the end of November, POD 


104 Reid Standish, “For Finland and Norway, the Refugee Crisis Heats Up Along the Russian Arctic,” 
Foreign Policy , January 26, 2016, https://foreignpolicy.com/2016/01/26/for-finland-and-norway-the- 
refugee-crisis-heats-up-along-the-russian-arctic/; BBC News, “Norway Sends Migrants Back to Russia,” 
BBC News, January 19, 2016, sec. Europe, https://www.bbc.com/news/woiid-europe-35355727. 

10 ^ Information gained through interviews with the local authorities in Finnmark County. 
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understood the emerging crisis in Finn mark and responded with support and increased the 
local capacity in the effort and supplied needed material, and the situation calmed. 

The described case illustrates some of the complexity hybrid threats induce, in this 
case by creating chaos and instability by non-violent or non-military means. Russia 
demonstrated its ability to utilize immigrants to overwhelm the Norwegian authorities for 
a given time, an approach similar to the allegations of how Russia may have weaponized 
Syrian migrants in Southern Europe the same year. 106 Russia’s innovative approach 
enabled chaos in the Norwegian security system and further uncovered a weakness in the 
Norwegian crisis response system as POD and the local police were not initially able to 
communicate effectively. While not being a regular military or SOF problem, the case 
shows the Norwegian police’s vulnerability to such a situation, and thereby introduces 
room for improvement and innovation. Flexible cross-sectoral cooperation and support 
could have force multiplied the local CoP in Finnmark county to regain situational and 
local control. The two following cases provide examples of Russian interference with 
electronic support systems, which in both instances affect the civilian society’s security in 
Norway. 

2. Case 2 

In 2017, Norway aviation systems experienced interference and jamming of the 
Global Positioning System (GPS) in Northern Norway. 107 Since 2017, especially in times 
of military exercises, Russia has jammed the GPS signal on several occasions. Naturally, 
this affects several parts of the Norwegian society, the civilian structures more than the 


106 Matthew Holehouse, “Nato Chief: Vladimir Putin ‘weaponising' Refugee Crisis to ‘Break’ 
Europe,” The Telegraph , March 2, 2016, sec. World, https://www.telegraph.co.uk/news/worldnews/ 
middleeast/syria/12180073/Nato-chief-Vladimir-Putin-weaponising-refugee-crisis-to-break-Europe.html; 
J.R. Nyquist and Anca-Maria Cernea, “Russian Strategy and Europe’s Refugee Crisis” (Center for Security 
Policy, May 29, 2018), 2-3, https://www.centerforsecuritypolicy.org/wp-content/uploads/2018/05/ 
Russia_Refugee_05-28-18.pdf. 

107 Aerospace Security, “GPS Jamming in the Arctic Circle,” CSIS, accessed June 17, 2019, 
https://aerospace.csis.org/data/gps-jamming-in-the-arctic-circle/; Krestia DeGeorge, “Norway Raises Issue 
of Arctic GPS Jamming with Russia,” Arctic Today (blog), January 22, 2019, https://www.arctictoday.com/ 
norway-raises-issue-of-arctic-gps-jamming-with-russia/. 
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military. 108 Civilian airlines, shipping, and personal navigation systems in cars are all 
affected by the jamming. In more urgent emergencies such as search and rescue operations, 
the GPS jamming could have potentially lethal outcomes. Norway and NATO are publicly 
declaring that the GPS jamming signal deploys from Russia. 109 On the other hand, the 
Russian government profits from its plausible deniability and denies the accusations from 
Norway, 110 and indicates the allegations to be part of Norway’s distraction campaign after 
the sinking of the Norwegian frigate KNM Helge Ingstad : 

Some Western politicians have become accustomed to blaming Russia for 
all sorts of incidents, without providing any evidence and without 
requesting official comments from Russia. Considering the Russian 
Federation’s unprecedented openness in the military sphere, our Norwegian 
partners could obtain competent answers to everything in question, which 
is of interest to them, if they wanted to. I would like to draw the attention 
of the Norwegian media to the fact that we did not receive any official 
inquiries. One cannot help but think that the Norwegian Defence Minister 
needs all these ridiculous stories to divert public attention from a scandal 
involving the Royal Norwegian Navy’s brand-new frigate Helge Ingstad 
that collided with an oil tanker in a maritime blunder on November 8 and 
sank near Bergen, western Norway. 111 

As the jamming signal originates from the Russian side of the border, Norway must 
rely on diplomatic abilities to confront the problem. Consequently, as Russia appreciates 


108 “gps Jamming Jeopardizes Public Safety in Norway’s Northernmost Region,” The Independent 
Barents Observer , accessed June 17, 2019, https://thebarentsobserver.com/en/security/2019/01/gps- 
jamming-jeopardizes-public-safety-norways-northernmost-region; Elisabeth Braw, “The GPS Wars Are 
Here,” Foreign Policy (blog), accessed June 17, 2019, https://foreignpolicy.com/2018/12/17/the-gps-wars- 
are-here/. 

109 Norwegian Intelligence Service, “Focus 2019- The Norwegian Intelligence Service’s Assessment 
of Current Security Challenges,” 2019, 27, https://forsvaret.no/fakta_/ForsvaretDocuments/ 
focus2019_english_web.pdf; GPS World, “Norway, Finland Suspect Russia of Jamming GPS,” GPS 
World. November 12, 2018, https://www.gpsworld.com/norway-finland-suspect-russia-of-jamming-gps/. 

110 “Moscow Says Norway’s Accusations about GPS Jamming Are ‘Absurd,’” The Independent 
Barents Observer , accessed June 17, 2019, https://thebarentsobserver.com/en/security/2018/ll/moscow- 
says-norways-accusations-about-gps-jamming-are-absurd. 

111 Ministry of Foreign Affairs of the Russian Federation, “EpucjtHHr o(|)Hi[Ha.aiuioro npc/iCTarmTCJifl 
MH/I Pocchh M.B.3axapoBoit, MocKBa, 22 iioaopH 2018 ro/ta [Briefing by Foreign Ministry Spokesperson 
Maria Zakharova, Moscow, November 22, 2018],” Ministry of Foreign Affairs of the Russian Federation, 
November 22, 2018, http://www.mid.rU/foreign_policy/news/-/asset_publisher/cKNonkJE02Bw/content/id/ 
341508 l?p_p_id=101_INSTANCE_cKNonkJE02Bw&_101_INSTANCE_cKNonkJE02Bw_languageId=e 
n_GB. 
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plausible deniability and utilizes misinformation to distract the public, the jamming may 
continue without any proper Norwegian response. 

3. Case 3 

In 2018, a Norwegian officer aimed his thesis to show how big data and social 
network analysis could contribute to better maritime situational awareness. 112 The thesis 
mapped hybrid threats projected from Russia by looking at ship movement in Norwegian 
waters between 2014 and 2017 through the maritime Automatic Identification System 
(AIS) combined with social network analysis (SNA). AIS is a civilian anti-collision system 
implemented by the International Maritime Organization (IMO) to increase safety at sea. 
The AIS tracks commercial vessels at sea by satellite and by land-based ground stations 
able to monitor the littoral areas approximately 40-60 nautical miles from the shoreline. 
By international standards established by IMO, all vessels more than 300 tons are obligated 
to use AIS. The study focused on data found on Russian ships in Norwegian waters or the 
vicinity and studied the Russian vessels’ activity and behavior around Norwegian naval 
bases, oil installations, and national and NATO military exercises from 2014 to 2017. The 
study identified Russian commercial vessels breaking out from “normal” and predicted 
commercial sea lines according to their primary task to perform another set of assignments. 
It also revealed Russian ships systematically switching their AIS transponder on and off in 
some specific areas on several occasions. Furthermore, during allied training and exercises 
in Norway, the study revealed an increase in abnormal activity among Russian ships in the 
areas where Norwegian or NATO vessels and activity were present. 

The ships were never inspected or monitored by Norwegian authorities, so the 
vessels’ intention or activity or remains unknown. Every single episode represents a ship 
moving between harbors and presents no apparent threat or state-organized activity. 
Nonetheless, the systematically altered routes and behavior in specific areas by several 


112 Stian Schnelle, “Kartlegging av maritime hybride trusler [Mapping Maritime Hybrid Threats]” 
(master’s thesis, Oslo, The Norwegian Defence Command and Staff College, 2018), 111-13, 
https://fhs.brage.unit.n 0 /fhs-xmlui/bitstream/handle/l 1250/2583966/ 
2018%20Masteroppgave%20Schnelle%20Stian.pdf?sequence=l. 
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Russian vessels over three years indicate organized divergence from commercial intentions 
and activity Russia desires to remain veiled. 

The given examples show that Russia is projecting state-organized hybrid threats 
to Norway in multiple ways. The cases also demonstrate the complexity of hybrid threats 
as they prove hard to verify or attest to its origin. Moreover, as visualized by Figure 4, 
when hybrid threats develop and occur, it may be challenging to tie the situation to a 
grander situational overview, but they display more clearly in a retrospective analysis, 
when the political objective becomes apparent. None of the cases explained are of a 
military character or mandate military responses. They do, however, demonstrate situations 
not typical for the local authorities and police forces, situations which somehow overwhelm 
or outmaneuver the local capacities available. A lower threshold for cross-sectoral 
cooperation where the local police more easily ask for military support in extraordinary 
events would enable the local police to more appropriately and more potently respond in a 
crisis. 

F. THE NORWEGIAN MILITARY’S RESILIENCE TO HYBRID ATTACKS 

After 9/11, Norway’s military forces have focused on professionalization and, in 
general, allied efforts in military campaigns abroad. This section explains how the current 
military structure functions in regard to hybrid scenarios, and further clarifies how 
Norway’s strategic leadership tries to decrease the potential of a hybrid threat through 
different means. The thesis presents NORSOF as the only reliable and prepared military 
forces for rapid engagements in a potential gray zone crisis. This section ends by 
elaborating two cross-sectoral episodes from 2005 between Russia and Norway 
challenging Norway’s security apparatus. As tension escalated between Russian fishermen 
and the Norwegian Coast Guard, the situation resulted twice in a muster of NORSOF. 
While not representing a hybrid threat or having any links to the Russian government, the 
episode remains interesting as it describes the Norwegian reaction, which is essential to 
appreciate when describing the effect hybrid tools have in the operational environment. 

In reference to national security in Norway, three pillars exist: security of the state, 
security of society, and individual security. When referring to a security crisis, this thesis 
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discusses a crisis that “falls short of a full-scale armed attack but still threatens Norway’s 
territorial integrity and or sovereignty.” 113 Security of the state refers to the “ability to 
safeguard the state’s sovereignty and integrity and secure political freedom.” 114 Security 
of the society refers to the ability to hinder domestic internal threats maintained by the 
national response units. 115 Figure 12 visualizes the dynamic and escalation between the 
different crises, and shows the lead ministry during the different potential crises. 


National security 

War, military pressure, severe attack 
Collective defence 

- NATO Article 5 

- Coalition of countries willing and able 
National defence effort 

- Lead Ministry: PMO/MFA/MOD 
Means: all available resources 


Security crisis 
Between peace and war 
Integrity and sovereignty threatened 
Foreign actors involved 
Allied support relevant 
Possible escalation 
Lead Ministry: PMO/MFA/MOD/MOJ 

Means: diplomacy, Armed Forces, police, other civilian resources 


Societal security 

Safeguard life, health, safety, critical functions and infrastructure 
Lead Ministry: MOJ or other civilian ministry 
Means: police, other civilian resources, possible support from 
the Armed Forces _ 



The Armed 
Forces' most 
demanding 
tasks 


Figure 12. The crisis scale and the NOR Armed Forces’ most 
demanding tasks 116 


113 Ministry of Defence (of Norway), Unified Ejfort- Expert Commission on Norwegian Security and 
Defence Policy, 8. 

114 Det Kongelige Forsvarsdepartement, Prop. 151 S (2015-2016). Kampkraft og baerekraft. 
Langtidsplan for Forsvaret [Capable and Sustainable. Long Term Defence Plan] (Oslo, Norway: Det 
Kongelige Forsvarsdepartement [The Royal Department of Defence], 2016), 5, https://www.regjeringen.no/ 
Contentassets/a712fb233b2542af8df07e2628b3386d/no/pdfs/prp201520160151000dddpdfs.pdf. 

115 “Prop. 151 S (2015-2016). Kampkraft og baerekraft. Langtidsplan for Forsvaret [Capable and 
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116 Source: Ministry of Defence (of Norway), Unified Effort- Expert Commission on Norwegian 
Security and Defence Policy, 9. 
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Regarding the security of the state and society, Norway’s security conditions have 
recently changed, and its security environment is currently more challenging than it has 
been since the Cold War. 117 After the Cold War, Norway altered its military powers. From 
an invasion and defensive-oriented national defense system based on conscripts, the 
military transformed into specialized professional armed forces, consisting of smaller 
mobile units. 118 Due to Norway’s focus on NATO operations abroad, the need for reaction 
forces overgrew the necessity and focused on national mobilization. However, the threat 
from the East reemerged, and currently, traditional security challenges stress Norway once 
again. With its shared border with Russia, Norway remains an important NATO outpost in 
the Arctic areas of the North Atlantic: 

Membership of NATO and the Transatlantic security community is the 
cornerstone of Norway’s security policy. Over the last years, Russian 
military activity in the north has increased. This increase in activity is not 
considered to be targeted at Norway, but is nevertheless an important factor 
in Norway’s security and defense policy. The role played by the Norwegian 
Armed Forces in exercising sovereignty and providing situational 
awareness in the north is an important element of the Government’s overall 
Arctic policy. The long-term defense plan emphasizes the need for the 
Norwegian Armed Forces to be able to operate together with Allied forces 
in the north. 119 

The asymmetry between the Norwegian and Russian military capabilities is 
increasing. Thus, the support and security provided through the NATO alliance are of 
utmost importance for Norway. 120 Norway’ s NATO dependence is a well-known fact, and 
a vital part of Russian planning if a conflict arises based on disputes about resources or 
regional rights in the Arctic. For Russia, NATO is an undesirable opponent; consequently, 
in a potential conflict or clash with Norway, it will be crucial for Russia to engage with 


117 Ministry of Foreign Affairs (of Norway), Meld. St. 36 (2016-2017) Setting the Course for 
Norwegian Foreign and Security Policy, 5. 

118 Ministry of Defence (of Norway), Unified Effort- Expert Commission on Norwegian Security and 
Defence Policy, 16. 

119 Norwegian Ministries, Norway’s Arctic Strategy - between Geopolitics and Social Development 
(Oslo, Norway: Norwegian Ministry of Foreign Affairs, 2017), 18, https://www.regjeringen.no/ 
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Norway below the threshold of any NATO Article V situation. Thus, hybrid threats are 
currently the most likely provocation Norway will face and are more likely to force Norway 
into a national or international crisis than any conventional acts of war. 121 

The armed forces are the Norwegian government’s apparatus to maintain Norway’s 
sovereignty, integrity, and existence, and are given the following responsibilities by the 
Norwegian Parliament: 

1. Ensure credible deterrence based on NATO’s collective defense 

2. Defend Norway and allies against threats, aggression, and attacks, 
within the framework of NATO’s collective defense 

3. Prevent and manage incidents and security crises, including the 
facilitation of allied support 

4. Ensure a national basis for decision-making through surveillance and 
intelligence 

5. Safeguard Norwegian sovereignty and sovereign rights 

6. Exercise Norwegian authority in designated areas 

7. Participate in multinational crisis management, including peace 
operations 

8. Contribute to international security and defense cooperation 

9. Contribute to societal security and other key societal tasks 122 

While most of the stated areas of responsibility focus on the security of the state 
and defending national and allied territory, assignment number 9 directs security of the 
society. The armed forces’ support to the security of the society usually is supplementary 
to the civilian efforts when the armed forces either possess competence or capacities the 
civilian side does not have or if the civilian resources are not sufficient to address the 
situation alone. 123 For example, the armed capabilities of the armed forces are a natural 
contribution in support of a given attack against Norway’s population and critical 


121 Norwegian Intelligence Service, “Focus 2019- The Norwegian Intelligence Service’s Assessment 
of Current Security Challenges,” 8-9; Politiets Sikkerhetstjeneste, “Threat Assessment 2019,” 2019, 7-13; 
Norheim-Martinsen et al., Del nye totalforsvaret [The New Total Defense], 21. 

122 Ministry of Defence (of Norway), Capable and Sustainable- Long Term Defence Plan (Oslo, 
Norway: Norwegian Ministry of Defence, 2016), 4, https://www.regjeringen.no/globalassets/ 
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123 Ministry of Defense and Ministry of Justice and Public Security (of Norway), Stptte og samarbeid, 
En beskrivelse av totalforsvaret i dag [Support and Cooperation, a Description of the Current Total 
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infrastructure or national capacities. In the case of a national security crisis or armed 
conflict, it may be challenging to recognize the situation as military or civilian in nature: 


In the future, one cannot exclude political pressure targeting Norway with 
a threat of military force or, in worst case, an armed attack against 
Norwegian areas. Neither can one exclude terrorism or cyber-attacks of 
such a character that the security of the state is challenged. The borders 
between peace, crisis, and armed conflict are no longer distinct. To achieve 
political coin, one cannot exclude the combination of a foreign state of 
means. Along with threats of military power projection, covert assaults 
towards national critical functions and actions directed to divide the 
population and create distrust to the legal authorities. 124 

The acknowledgment of hybrid threats as part of the increased international tension 
with Russia has given the Norwegian concept Total Defense [ Totalforsvaret ] a renewed 
focus. During the Cold War, Norway established the concept of Total Defense, which 
enabled the whole of government approach in case of war, a theory based on two pillars: 
the military defense and the stated responsibilities and readiness of the civilian society. 125 
As mentioned, the Total Defense vanished after the Cold War. Nonetheless, because of the 
increasing threat from Russia in recent years, especially after the annexation of Crimea in 
2014, Total Defense is once again relevant, though in a different design from its forerunner. 
The new Total Defense can be applied in times other than war and is more flexible and 
available when needed. 126 The Total Defense goal is to utilize the whole spectrum of 
available resources in Norwegian society most forcefully in times of crisis, regardless of 
whether the threat is to the state or the society. 127 

A national crisis challenges national resources. A crisis as such, may lead 
to an authority or sector’s incapability to handle the crisis. At that point, it 
is necessary to concentrate parts—or the totality—of national resources. 
Examples of situations range from unforeseen situations, such as nature or 
environmental disasters, via immigration flow, major accidents and 
pandemics to intentionally situation as episodes in Norwegian waters, 


l 24 Ministry of Defense and Ministry of Justice and Public Security (of Norway), 27. 
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terrorism against the population, industry, or other infrastructure, to limited 
armed attacks. 128 

Norway’s new aspirations for its Total Defense concept ratify the utilization of NORSOF 
in gray zone challenges and hybrid threats. 

The Norwegian government has delegated the responsibility for coordination of the 
Norwegian Total Defense concept to the MoJPS. 129 As visualized in Figure 11, the MoJPS 
is in charge of coordinating the civilian efforts and the respective subunits involved in a 
situation, and remains as the leading party until new directives are given, 130 normally 
described as a military crisis by the Crisis Council. In a military crisis, the commander of 
the NJHQ will be handed the operative responsibility through guidelines from the 
commander of the armed forces. In a stated crisis, the different ministries will retain their 
constitutional responsibilities, and each ministry is responsible for its respective operative 
situational awareness needed to identify its required actions in its departments. 

A inherent part of the Total Defense is the armed forces’ responsibilities, which 
after the new Total Defense concept and new regulations, no longer only demonstrate 
power in war and security crisis, but are available resources in times of peace as well. 131 
One of these responsibilities is serving in a supportive role to the police, regulated by law 
[ politiloven ] and the “Instructions on the Armed Forces’ assistance to the Police” 
[bistandsinstruksen] from 2017. The new instructions on assistance give police authorities, 
usually the local CoP or the Police Directorate (POD), the option to request military support 
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through NJHQ, unlike the former one, where the request addressed the ministry level. 132 
The ministries remain the authority for reactive withdrawal or guiding military support. 

1. Norway’s Special Operations Forces 

NORSOF has a designed and specified responsibility for counterterrorism (CT) 
support to the police. 133 Among its ground forces, the CT mission is the only responsibility 
the Norwegian armed forces have with a domestic focus and it requires movement on short 
notice. The Army SOF [Forsvarets Spesialkommando ] was initially established and 
developed in 1982 to support the police in CT missions. The Naval SOF 
[Marinejegerkommandoen] was assigned to the CT support mission in 2013. In total, 
NORSOF is trained, prepared, and equipped to support the police in situations where the 
police are overwhelmed or do not have resources or training for the given situation, 
especially in the maritime domain. As the CT mission includes NORSOF’s standby 
readiness, both in personnel and equipment, the readiness enables NORSOF’s rapid 
reaction ability in case of a hybrid attack where ground forces are required. Norway’s 
conventional military system is based on a conscript system that rotates annually, which 
prevents most of the Norwegian conscripts during their first six months of service as the 
conscripts do not have the level of expertise needed. This gives the NJHQ two options: 
either reenlist the recently graduated conscripts or mobilize its professional forces. Of the 
two, the latter is the only realistic response. The professional forces, however, are infantry- 
focused units and thereby designed for infantry-similar responses; that is, they are better 
utilized in situations such as a more established conflict than the initial phase of a hybrid 
attack. 


132 Forsvarsdepartementet, Instruks Om Forsvarets Bistand Til Politiet - Lovdata [Instructions on the 
Armed Forces’ Assistance to the Police] (Oslo, Norway: Forsvarsdepartmentet, 2017), https://lovdata.no/ 
dokument/LTI/forskrift/2012-06-22-581; Forsvarsdepartementet, “Flar fastsatt ny instruks for Forsvarets 
bistand til politiet [New instructions on the Armed Forces’ Assistance to the Police],” Pressemelding, 
Regjeringen.no, June 16, 2017, https://www.regjeringen.no/no/aktuelt/har-fastsatt-ny-instruks-for- 
forsvarets-bistand-til-politiet/id2557595/. 

133 Ministry of Defense and Ministry of Justice and Public Security (of Norway), St0tte og samarbeid, 
En beskrivelse av totalforsvaret i dag [Support and Cooperation, a Description of the Current Total 
Defense], 59. 
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Furthermore, Norway’s professional forces are highly sought for capacity in NATO 
operations, and the professional units are known for a high operational tempo and number 
of deployments. Without a stated mission set for the professional forces in Norway, they 
cannot be included in the defined plans for Norway’s rapid hybrid response actions. SOF 
should in general concentrate its efforts on two sets of activities—“the activities no other 
military forces conduct, and the activities also conducted by other forces, but not to the 
standard SOF can produce.” 134 As Norway does not have any designated units trained to 
counter hybrid warfare or gray zone operations, and NORSOF is prepared and trained for 
rapid deployment in a national crisis, NORSOF’s units are the only two realistic ground 
forces to include among the Norwegian armed forces for a rapid response to counter hybrid 
warfare. Furthermore, because of SOF’s nature of embracing cultural understanding and 
flexibility as fundamental core abilities, NORSOF materialize as well-designed and trained 
for cross-sectoral cooperation in small teams with critical responsibilities. 135 In total, 
NORSOF stands out as the force of choice to serve as the interdepartmental bridge to break 
cross-sectoral boundaries. 

Despite the current debate over hybrid warfare and cross-sectoral challenges, the 
phenomenon is not new. Such challenges have been up for discussion before; however, the 
current utilization of cross-sectoral means to gain political objectives as an effective way 
of warfare is new. Norwegian authorities have met similar challenges before. The 
following two vignettes describe the situation when NORSOF units were mustered and 
deployed in support of the local authorities to maintain Norway’s sovereignty in disputes 
with Russians. It is essential to state that the two cases represented in this section do not 
demonstrate any examples of hybrid warfare or give any indications of being executed 
from any central Russian leadership. While the two governments opposed each other in 
these scenarios, the disputes escalated from civilians who disagreed with local law. 
Nevertheless, as this study aims to describe NORSOF’s operational environment during a 
hybrid attack, the two cases remain relevant as they illustrate the problem multi-sectoral 


134 Joint Special Operations University, Special Operations Forces Reference Manual, 1-2. 
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threats represent to Norway regarding which sector owns the situation, what is the proper 
response, and how to balance the response without escalating an already politically delicate 
situation. If not addressed, these problems will continue hindering an effective national 
execution in a potential crisis as they will negatively affect the operational environment. 

G. NORWAY’S PREVIOUS RESPONSE TO CROSS-SECTORAL 

CHALLENGES 

In the fall of 2005, two disputes over rights regarding resources in the Barents Sea 
arose between Norway and Russia. Each dispute involved from tension between Russian 
fishing trawlers and the Norwegian Coast Guard, who enforced Norwegian law in the 
Svalbard Fisheries Protection Zone. Escalation of the dispute twice led to a secret muster 
and deployment of Norwegian SOF. Both situations were resolved without the employment 
of SOF, and in hindsight, they might stand as an example of over-reaction by Norwegian 
authorities. Yet, both cases also stand as an example of a multi-sectoral challenge to 
Norway and may represent an arena for learning to improve national countermeasures to 
hybrid difficulties in the future. This section elaborates on each case separately. 

1. The Elektron Conflict 

In July 2005, the Russian fishing trawler Elektron sailed out from Murmansk, 
Russia, towards the Barents Sea Foophole. After three months without success in its 
fishing, Electron sailed into the Fisheries Protection Zone (FPZ), which encircles the 
Norwegian archipelago Svalbard. 136 On October 15, the Norwegian Coast Guard vessel 
KV Troms0 approached the Elektron , suspicious of illegal fishing in the FPZ, and sent two 
inspectors to board Elektron , a routine maneuver in such situations, with the intent to secure 
evidence to hand over to Russian authorities. The Russians met the Norwegian inspectors 


136 Utenriksdepartementet [The Ministry of Foreign Affairs], “The Russian Trawler Elektron,” Nyhet, 
Statsministerens Kontor [The Office of the Prime Minister], October 18, 2005, https://www.regjeringen.no/ 
en/aktuelt/the-russian-trawler-elektron/id419626/; Utenriksdepartementet [The Ministry of Foreign 
Affairs], “Report No. 30 to the Storting (2004-2005), Opportunities and Challenges in the North,” 
Stortingsmelding (The Norwegian Ministry of Foreign Affairs, April 15, 2005), 24—26, 
https://www.regjeringen.no/en/dokumenter/report_no-30_to_the_storting_2004-2005/idl98406/; Sigrid S. 
Engebretsen-Skaret, “Bruk av norske spesialstyrker i krisehandtering - utfordringer og muligheter [The Use 
of Norwegian Special Operations Forces During Crisis Management - challenges and opportunities]” 
(Norway, Forsvarets Hpgskole, 2012), 29-31, https://fhs.brage.unit.no/fhs-xmlui/handle/11250/196524. 
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as usual and did not show any signs of hostility initially. During their inspection, the Coast 
Guard inspectors discovered severe violation of fishery regulations. Due to the scope of 
the violations, the Russian trawler was commandeered, and ordered to set course towards 
the city of Tromsp, in Northern Norway. The inspectors remained onboard Elektron. On 
the morning of October 16, on its way to Tromsp, the Coast Guard observed that the 
Russian captain of the Elektron , Jarantsev, disobeyed the Coast Guard’s orders, and reset 
the ship’s course toward Murmansk. In response to Norwegian orders, Captain Jarantsev 
responded that the shipping company in Murmansk had ordered him not to comply with 
the Norwegian Coast Guard. 137 The Coast Guard immediately ordered the Elektron to reset 
its course toward Tromsp; however, Jarantsev refused and proceeded toward Russia, with 
two Norwegian Coast Guard officers held as hostages onboard. The Coast Guard alerted 
the Norwegian authorities, and by the afternoon of October 16, the Landsclelkommando 
Nord Norge [Regional Command Northern Norway] (LDKN) ordered 
Marinejegerkommandoen [NORNAVSOF] (MJK) to support the Coast Guard in its 
mission due to the escalation of the situation. 

MJK rapidly mustered a team ready to deploy to the Coast Guard vessel tracking 
Elektron. On the evening of October 16, the Norwegian Ministry of Defense (MoD) 
approved a boarding operation to secure both the Norwegian hostages and the Elektron’s 
course towards Tromsp. Due to bad weather in the Barents Sea, however, the boarding 
operation was not possible. On October 17, the MJK operators got forwarded along with 
officers from LDKN to support the Coast Guard in its mission further, and the MoD once 
again gave its approval for the boarding operation, but again, the weather halted the 
process. Later the same day, October 17, the Norwegian government ordered the boarding 
team from MJK to stand down but ordered the Norwegian Coast Guard vessel to continue 
its tracking of the Elektron as it was moving towards Russian waters. On October 18, the 
Norwegian government redeployed the operators from MJK, as the central government 


' 37 Forsvarsdepartementet, Rapport Fra Arbeidsgruppen for Utredning Av Oppgave- Og 
Myndighetsfordelingen Mellom Kystvakten, Politet Og Paatalemakten. [Report from the Examination 
Group of Tasks and Authority Distrubtion between the Coast Guard, Police and Prosecuting Authorities] 
(Oslo, Norway: The Norwegian Ministry of Defence, 2008), 15, https://www.regjeringen.no/globalassets/ 
upload/fd/dokumenter/kystv akten_myndighetsfordeling.pdf. 
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decided to solve the dispute through diplomacy and a political message stating that Norway 
expected Russian government officials to take control over Elektron and hold its leadership 
accountable for the situation. 

On the Russian authorities’ side, Foreign Minister Sergej Lavrov and Minister of 
Defense Sergej Ivanov officially supported the captain of the Elektron’s decision, stating 
that the Norwegian Coast Guard could inspect Russian fishing vessels, but had no authority 
to commandeer any Russian ships. As a response to the Norwegian Coast Guard tracking 
of Elektron towards Russian territorial waters, Russia deployed the naval destroyer 
Admiral Levtshenko in support of the Elektron. 138 At one point, the destroyer demonstrated 
its power as it locked a missile on a Norwegian Orion surveillance aircraft, which tracked 
the situation. 139 Naturally, the Orion aircraft left the position. At a local level, the shipping 
company, along with Murmansk media, depicted the Elektron as a victim, claiming 
Norwegian authorities had abused their power. On October 20, the Norwegian Coast Guard 
officers were released from captivity and transported back to the Norwegian Coast Guard 
vessel KV Troms0 in Russian territorial waters. There was no physical harm done to the 
inspectors. 

In hindsight, the political leadership in Norway stated that the police should have 
handled the Elektron case. As the Elektron case proceeded, the situation was controlled by 
the Norwegian armed forces at a tactical and operational level, without involvement from 
the Norwegian police. 140 Also, on October 16, the state prosecutor in Norway offered the 
help of the Norwegian police force Delta [ Beredskapstroppen ] to replace MJK’s role in the 
mission. However, the armed forces declined the offer. 141 In the aftermath of the Elektron 


138 Tor Hakon Inderberg, “Den Utenrikspolitiske Handteringen Av Elektronsaken: Kompetent 
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case, the Norwegian Minister of Defense and the Minister of Justice stated that the Elektron 
case was a civil matter and should accordingly be handled by the Norwegian police and 
the prosecutors. 

The described case illustrates some of the problems tied to the decision making 
cycle in cross-sectoral challenges. The usage of Norwegian military personnel against 
Russian civilians may escalate the situation unintentionally and is a matter of political 
sensitivity. Also, the maritime aspect of the situation intensifies the complexity as the 
situation is continuously relocating. While control of a land-based case can be gained by 
presence and isolation, a situation in the maritime domain is both highly dynamic and 
unforgiving, because the changing geography alters rules and regulations, and the weather, 
as described in the Elektron case, may compromise the operational window. As illustrated, 
in retrospect, Norwegian authorities decided that the police should have handled a situation 
such as the Elektron case. According to NATO terminology, the Elektron case would 
probably fall under the definition of an involuntary diversion, which refers to boarding 
situations “when the suspect vessel is non-cooperative but once the suspect vessel has been 
boarded and secured the use of force is not required to gain compliance of the suspect 
vessel .” 142 In other words, the adversary ship will not support or help the boarding team 
onboard, nor will it comply if ordered to reduce speed or to simplify the situation for a 
boarding force, but when boarded, the crew will submit and not resist the boarding force. 
For such a boarding operation, operational speed and a sufficiently sized force are 
cornerstones to make the operation as safe as possible for all parts of the conflict . 143 
Moreover, the weather and climate in the Arctic region challenge any operation in the area, 
especially boarding operations, as the Elektron case demonstrates. The described 
circumstances call for adequately trained and equipped personnel on standby readiness to 
secure operational success and maintain adequate safety for the personnel. Such training 
and knowledge are not what one can expect from regular police officers, which means that 

142 North Atlantic Treaty Organization, ATP-71, Allied Maritime Interdiction Operations, ATP 
(NATO Standardization Agency, 2005), 6-1, 6-2, https://www.pdffiller.com/jsfiller- 
deskl0/?projectld=398573462#33debc97aa86c27bb716545e0286febb. 
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55 



local police forces employed in a similar case are exposed to a risk they are not qualified 
to manage properly. Thus, NORNAVSOC’s presence would enable a CoP in a similar 
situation. In total, despite the lesson learned stating that it is a police mission, this analysis 
of cross-sectoral challenge demonstrates that interdepartmental cooperation would be most 
beneficial for the Norwegian security apparatus. 

2. The Bjprnpya Case 

Almost at the same time as the Elektron case was happening, another dispute 
between Russian fishers and the Norwegian Coast Guard emerged. On October 22, the 
Coast Guard vessel KVNordkapp discovered illegal fishing and transshipment between the 
Russian trawler Gorbachev and the Russian cargo ship Dimitry Prokramovich in 
Norwegian waters during an inspection conducted by Norwegian Coast Guard officers. 144 
The two Russian vessels sailed into the waters surrounding Bj0rn0ya, which is an island of 
the Norwegian archipelago Svalbard. After dialogue between the district attorney in Troms 
(mainland Norway), the Governor of Svalbard [ Sysselmannen ], and KV Nordkapp , it was 
explained to the two Russian vessels that they were under custody, and ordered to sail 
towards Troms0. The Russians refused to follow the order and said they would follow 
Russian law, not Norwegian law, in those waters. The captain of Dimitry Prokramovich 
further explained his decision based on his dialogue with the ship owner and the Russian 
armed forces, who also stated that Norwegian law did not rule in those waters. 145 The 
Russian captain directed the Coast Guard to continue its dialogue with the Russian 
Embassy in Oslo through the Norwegian Ministry of Foreign Affairs. The Coast Guard, as 
a military force, reported as usual to LDKN. 


144 Engebretsen-Skaret, “Bruk av norske spesialstyrker i krisehandtering - utfordringer og muligheter 
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Simultaneously, the dialogue and reports between the LDKN and the Norwegian 
armed forces national joint headquarters (in 2005 named FOHK) resulted in a warning 
order to the Norwegian Army’s special operations forces (FSK), as the employment of SOF 
as a boarding force was an operational option if the situation escalated. On October 24, 
FSK was ordered by the FOHK to establish a command and control (C2) team at LDKN 
and to deploy an assault force to the Coast Guard. During the Elektron case, the SOF team 
from MJK was in support of the Coast Guard, and thereby the LDKN had operational 
control. During the Bjprnpya case, however, the SOF support from FSK was in support of 
the Governor of Svalbard. A natural result thus was FOHK as the executive leadership for 
military involvement. To present a sufficient tactical structure, the commander of FSK 
advised the commander of FOHK, Admiral Jan Reksten, to deploy an entire task group 
instead of the 12-man team FOHK asked for. Admiral Reksten concurred. LDKN 
continued its contingency planning if the governor did not succeed in his work to get the 
Russians to cooperate. A part of the plan was to forward the FSK operators toward 
Bjprnpya to decrease the reaction time if SOF involvement became necessary. The 
operators’ instructions and rules of engagement (ROE) were according to the Norwegian 
law [ Politiloven ], which specified a minimum use of force, and only hostile acts from the 
boarded crew allowed an armed response in case the situation required a military boarding 
of the Russian vessels. One of the first requests for information (RFI) FSK forwarded to 
FOHK regarded the situational leadership, and whether it was a military operation or 
military assistance to the police; however, the FOHK could not provide any clarification 
on this matter to FSK due to the situational complexity at the time. 

The governor, whose background is as a Norwegian police officer, is the local 
leadership of Svalbard, and thereby he was in charge of the situation that escalated. Also, 
governor reports to the Ministry of Justice. 146 As long as the situation remains a police 
matter, a concept involving military forces is considered enforcement assistance 
[handhevelsesbistand]. In other words, it is still the Norwegian police that decides and 
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leads the operation, while the military assistance enables the police to achieve its 
enforcement of Norwegian law. If a Norwegian SOF unit is employed and supports the 
police, it is of utmost importance to clarify the ROEs. Because of the political sensitivity 
of the mission, an authorization from MoD was required before the task could be executed. 

On October 26, the MoD restricted the FOHK from deploying the FSK operators 
to Bjprnpya before the MoD approved such a movement, or if the governor requested 
FSK’s presence. Furthermore, the presence and profile of FSK’s involvement were ordered 
to remain as low and indistinct as possible because of the sensitivity of the situation. On 
the civil side of the case—and the local leadership—the governor communicated that he 
did not intend to use SOF personnel, but wanted more police officers to be flown in from 
the Norwegian mainland to support the situation. To support the governor, the CoP in 
Tromsp refused the armed forces’ helicopters to refuel at the local fuel plant at Bj0m0ya 
as long as the helicopters carried military personnel on board. Because of the distances in 
the Barents Sea, the helicopters required refueling at Bj0m0ya to remain operational. This 
decision led to harsh circumstances between the Ministry of Justice (MoJ) and the MoD 
and the Ministry of Foreign Affairs (MoFA). 

The governor also expressed that no Norwegian representative was allowed to 
board the ships armed with weapons, neither police nor military forces (the Norwegian 
police did not normally carry a sidearm in 2005). These orders did not comply with the 
military directives at FOHK, and the commander of FSK advised FOHK that the 
employment of unarmed SOF was not appropriate. The governor requests led to a 
redeployment, and re-assignment to FSK. The new assignment from the FOHK ordered 
FSK to support the Coast Guard in its mission, instead of the governor. The Norwegian 
armed forces further recommended the police’s national special weapons and tactics 
(SWAT) team. Delta, to succeed FSK’s role in the situation. Five days after the operation 
initiated, the government decided to carry out the operation with the Norwegian police SOF 
unit supported by a local police SWAT team [UEH] from Trondheim, as the MoJ stated 
the situation was a civil matter. Before the situation escalated further, the ship owners in 
Russia agreed to provide economic security for the two Russian trawlers, which 
deescalated the situation back to normal, and the debate over forces and utilization came 
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to an end. As the case was solved through diplomatic work, the police teams were never 
employed. During the whole situation, the governor and FSK never communicated but 
remained in their organizational sectors. 

The Bj0m0ya case demonstrates the situational complexity that cross-sectoral 
challenges present. The fact that the FOHK could not immediately define the situation as 
military or civil, and the dispute over turf became central with the blocking of the military 
helicopters refueling options, illustrate the room for improvement between the Norwegian 
ministries. Interdepartmental communication could have, possibly, improved the situation 
and increased the governor’s trust in FSK. However, as the lines of communication ran 
through the centralized ministry level, FSK and the governor did not have any channels to 
organize and defuse the internal misunderstandings. In total, the two cases from the Barents 
Sea in 2005 illustrate that situational complexity and political sensitivity, along with 
organizational biases, hinder proper cooperation and communication needed between the 
ministries in Norway to solve cross-sectoral challenges effectively. 

H. BACKGROUND CONCLUSION 

The previous sections in this background chapter have described the Russian hybrid 
threats projected to Norway and why they are effective. After the Cold War, Norway 
downsized its military to become more professional and competent in NATO operations 
abroad. As the conflict between East and West reoccurred, Norway, like many other 
Western countries, was caught off-guard, primarily because of the innovative Russian 
approach. As the background elaborates, Russia’s power projection towards Norway 
through society, along with its implementation of technology, is effective, and currently, 
both Norway and NATO struggle to counter the threats. If the tension in the Arctic area 
increases and an incident between Russia and Norway escalates into a crisis, Norway 
should prepare for sub-Article V engagements through hybrid attacks. The political 
sensitivity in a gray zone conflict lessens the scope from tactical military activity to having 
a strategic impact, which advocates for ground forces with situational understanding and 
awareness. NORSOF, as Norway’s most appropriate military gray zone instrument, should 
thereby prepare for countering hybrid warfare as a military instrument operating in 
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sensitive environments, as well as a cross-sectoral facilitator and capability enabler. By 
enabling local authorities’ ability to produce appropriate countermeasures, NORSOF 
contributes actively to all three pillars—the security of the state, the security of the society, 
and the security of the individual. 
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III. RUSSIAN TACTICAL INNOVATION IN GEORGIA 

AND UKRAINE 


The press should be not only a collective propagandist and a collective 
agitator, but also a collective organizer of the masses. 

—Vladimir Lenin 


A. INTRODUCTION 

This chapter analyzes Russia’s engagements in Georgia and the Crimea peninsula 
to identify patterns and trends in the conflicts. Despite some shared situational factors, the 
two conflicts are unrelated stand-alone situations. Thus, as they reveal Russia’s modern 
ways of fighting and which tactics Russia deploys to pursue its strategical objectives, they 
can be used to provide assessments and forecast what to expect from Russia in a future 
conflict. Visualized by Figure 13, this thesis’s process of describing critical factors of an 
operational environment in a hybrid scenario follows from the two described conflicts, and 
thereby gives NORSOF factors to prepare for. 


Generate options for 
NORSOF to better face 
new operational 
environment 


Understand the 

challenges of hybrid 
threats and warfare 


Analyze the problem 


Learn from allied 



Figure 13. The operational environment 


This chapter’s goal is to describe the unconventional features and new 
characteristics of Russian tactics in the conflicts with the intent to display the tools 
employed in a potential future conflict during the period when a political situation escalates 
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from peace to a crisis. By identifying the tools deployed and lessons learned, the chapter 
aims to propose what Norway could expect in a potential national crisis. The analysis 
focuses on the initial phase of the conflicts and which combined domains and tools were 
synchronized to increase the relative effect each tool represents. Since President Putin came 
to power, Russia has been involved in several conflicts and displayed an innovative 
mindset and philosophy, as well as the national will to pursue its interests, even when its 
national interests conflict with those of other nations. 

The Russo-Georgian war became a significant eye-opener for Russia’s leadership 
and led to military reform and modernization in the Russian military in 2008. 147 The 
background for the military reform was the transformation from a major conscript-based 
military that was focused on a major war with another great power, a legacy from the Soviet 
Union, to one focused on minor armed conflicts with its neighbor states. One of the 
recognized areas for improvement among Russian forces in 2008 was the trust of its 
conscript system among Russia’s special forces [Spetsnaz], which rotated its conscript 
operators every three years. Learning from the West, Russia established a new force among 
its special operations forces, the new elite Spetsnaz ; Sil spetsialnykh operatsii (SSO), also 
known as “the Russian military scalpel.” 

Following, in 2014, Russia demonstrated its new tactical approach and surprised 
the West with its modern style of warfighting. The annexation of Crimea embraced 
Russia’s new hybrid warfare strategy through a massive cyber campaign, information 
warfare, and usage of proxy forces before, during, and after the use of conventional ground 
forces. With its strategy exposed in Crimea, Russia collapsed traditional thinking about 
war and peace when combining multiple instruments of power in a ratio of 4:1 nonmilitary - 
to-military action. 148 The combination of civilian and military operations, along with 
Russia being the largest country in the world and a permanent member of the United 
Nations (UN) Security Council, creates significant consequences, especially since 
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Vladimir Putin denied Russian involvement in the conflict for the first six weeks. 149 Based 
on Russian operations in Georgia in 2008 and Crimea, Ukraine, in 2014, one can identify 
patterns in the Russian tactics employed to reach strategical objectives. From Georgia as a 
testing ground to Crimea as its whetstone, Russia has improved and developed its hybrid 
tactics. Russia demonstrates a will to pursue its strategic objective of returning Russia to 
great power status. By studying the conflict in Georgia and Ukraine, the West has learned 
from the “new” Russia and its implementation of forces and powers not seen combined 
before. 

B. GEORGIA 

After the Cold War, Russia and the Republic of Georgia disagreed over the territory 
of South Ossetia and Abkhazia, which eventually led to the five-day-long Russo-Georgian 
war in 2008. 150 Internationally, most members of the United Nations recognized the South 
Ossetia territory as part of Georgia; however, pro-Russian enclaves in South Ossetia 
unilaterally declared independence from Georgia, leading to the triangular conflict. In 
1991, Georgia forces deployed into South Ossetia to regain control, leading Russia to 
deploy a peacekeeping force under the auspices of the Organization for Security and 
Cooperation in Europe (OSCE). 

After gaining its independence in 1991, Georgia looked westward in its pursuit of 
national development. In 1992, Georgia established relations with NATO, and in March 
1994, Georgia engaged in NATO’s partnership-for-peace agreement. 151 Russia followed 
into the same agreement in June the same year. As a former republic of the Soviet Union, 
Georgia’s orientation toward the West was not a popular move in the Kremlin, and when 
Vladimir Putin came to power, Russia increasingly worked on its influence in Georgia 
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through the separatists and enhanced its bonds to the region by granting citizenship to 
residents in the South Ossetia region. 152 After the April 2008 NATO summit in Bucharest, 
where Georgia was proposed as a member in NATO, Russia’s hunger for control in the 
region increased. During the summer of 2008, several clashes between Georgian security 
forces and separatists from South Ossetia broke out. As a result, Russia intervened to secure 
Russian citizens and interests; in August 2008, Russia invaded approximately 20 percent 
of Georgian recognized sovereign territory 153 in a war lasting five days, from August 7 to 
12. The employment of Russian forces was not random, but a well-planned maneuver from 
Russian leadership dating from the time of the Bucharest summit in April 2008, probably 
to prevent Georgia’s NATO membership. 154 

During the infiltration phase of the war, Russia demonstrated both tactical and 
logistical deception, as well as its national tradition of public deception [maskirovka]. To 
avoid the international media’s tension, Russia engaged Georgia the same day as the 
opening ceremony of the XXIX Olympiad in Beijing. As Beijing received most of the 
media coverage, Russia could pursue its regional objective in the shadows of the Olympics. 
To surprise its adversaries, Russia mobili z ed and maneuvered its forces by conducting 
military exercises at the Georgian border in July 2008. 155 The veil of the exercise worked 
successfully to disguise the larger goal and overcame the logistical challenges in moving 
the needed personnel and equipment to the border. After the covert infiltration to South 
Ossetia in Georgia, and the kinetic part of the war had been initiated, the Georgian forces 
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were shocked to find themselves fighting the Russian Army. 156 Throughout the conflict, 
Russia controlled much of the information crossing in and out of Georgia. By gaining 
informational control, Russia stated to both the local population involved in the conflict, 
as well as the international community, that Russia was simply protecting innocent citizens 
and Georgia’s government was the aggressor. 157 By comparing the situation to the NATO 
operations recently conducted in Kosovo, Russia implored the international audience to 
respect Russia’s right to protect its people. While Georgia unilaterally declared war, Russia 
claimed its invasion was a part of the peacekeeping mission. 158 Furthermore, Russia’s 
Foreign Minister, Sergei Lavrov, claimed that the Georgian government supported ethnic 
cleansing of the population of South Ossetia, 159 accusations later proved false by the EU’s 
independent investigation. 160 

Though imperfect, the Russo-Georgian war provided a template for warfare in 
multiple domains and the mixture of conventional forces and weapons along with 
unconventional forces and proxy forces. 161 For the first time in history, the war in Georgia 
included cyber operations as a new dimension to warfare. 162 As Russian troops 
simultaneously crossed the border into Georgia, pro-Russian criminals conducted multiple 
distributed denial of service (DDoS) attacks against the Georgian government. 163 A DDoS 
attack is constructed to overwhelm a website with traffic from multiple sources. Generally, 
the online service becomes unavailable as a result of a targeted DDoS attack. In Georgia, 
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the DDoS attack resulted in a crippled government unable to communicate with either its 
military leaders or its population. As a secondary result, panic grew among Tbilisi’s 
citizens. Even though the Georgian society’s internet and cyber capabilities had room for 
improvement and development, cyberspace became a significant, “if not decisive,” variable 
throughout the conflict. 164 While the Russian ground forces crossed the border into 
Georgia, several DDoS attacks hit the Georgian government, crippling its ability to direct 
its military or communicate with the Georgian population. 165 

Although it ostensibly had no direct connection to the Russian government, the 
cyber campaign successfully isolated Georgia and effectively influenced the Georgian 
population and its security forces through informational and psychological operations. 166 

Russia successfully integrated cyber warfare along with other non-kinetic 
mechanisms into traditional conventional warfare. On the other hand, by introducing the 
digital factor in its kinetic warfare, Russia advertised its military policy to achieve strategic 
and tactical objectives through cyber-crime, terrorism and proxy forces. 167 The lack of 
connection to official Russia gave the Kremlin essential plausible deniability from 
information operations, which importantly aimed at non-military targets. Russian criminals 
directed the cyber-attacks, and despite no direct evidence, the subsequent investigation led 
to reliable indicators and obvious links showing that the Russian criminals acted as proxy 
forces orchestrated through the Kremlin. Eventually, the DDoS attacks played a significant 
role “as a vector for generating strategic effects and outcomes.” 168 

The Georgian side of the conflict experienced several problems with command and 
control. 169 Its C2 capabilities were old and vulnerable to jamming, leading many 
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commanders to rely on insecure networks and private cell phones to distribute orders. 
Furthermore, when the conflict escalated, inexperienced civilian leaders in Tbilisi started 
micromanaging combat operations, resulting in military commanders becoming confused 
and paralyzed. Cyber warfare turned out to be a force multiplier that supported the 
operational objectives, and with its plausible deniability, cyber represented an evolution of 
warfare. 170 Furthermore, cyberwarfare in Georgia demonstrated how cyber intensifies the 
severe effect of information operations (10). In Georgia, Russia discovered how to prepare 
the battlefield both by inciting the local population with fake information to developing 
enough ambiguity, by distributing disinformation, to confuse its adversary. 171 In the days 
leading up to the invasion, pro-Russian hackers intensified attacks toward the Georgian 
government and population. 172 Several DDoS and website defacement attacks on both 
private and government web pages disrupted information distribution in Georgia. In this 
way, Russia isolated the Georgian society, making conditions favorable for the Russian 
campaign to follow. 

Russia also included proxy forces during the conflict by having Russian 
conventional forces fighting along with irregular forces. 173 Many of the irregular forces 
originated from the pro-Russia and Russian speaking parts of Georgia. The regular and 
irregular Russian forces looted and terrorized the Georgian population by raiding villages 
in South Ossetia. 174 

Russia learned a valuable lesson from the five-day war against Georgia. Despite 
several innovative breakthroughs, the war demonstrated that Russia’s C2 capabilities were 
outdated, as well were much of its Soviet-era munitions and equipment. 175 In total, despite 
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being the victorious part, the war “was a military embarrassment to Russia.” 176 Humbled, 
Russia’s military leadership realized its forces needed to modernize and develop. One of 
the strategical lessons learned in Russia after the Russo-Georgian war was for Russia to 
alter its primary security scenario from large-scale war with several adversaries to a focus 
on local conflicts along the Russian border. Also, as the war’s aftermath revealed that the 
Spetsnaz-GRU did not function along with the conventional Russian army, the military 
reform had fundamental consequences for the Russian SOF. 177 

The introduction of cyberwarfare in Georgia as a testing ground paved the way for 
Russia’s plans for Ukraine. 178 Despite the Russian focus on information warfare (IW), 
Russia learned from the conflict that its IW concept and doctrine needed to be improved. 
The information-psychological operations, in particular, had varying results. 179 The 
Georgia war gave Russia the substructure for an internal strength-weaknesses-opportunity- 
threats (SWOT) analysis and was in many ways a wake-up call for Russia. 180 The war, 
although won by Russia, revealed more vulnerabilities than strengths in the Russian 
military system. 181 The strategy alteration and lessons learned from the SWOT analysis 
led to a modernization of Russia’s military forces and the abandonment of its outdated 
mobilization system from the Soviet Union era. 

C. CRIMEA, UKRAINE 

The Russo-Georgian war became a playbook for Russia’s annexation of Crimea. A 
central finding for Russia in its war against Georgia was the effect of identifying weak 
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spots and exploiting internal crises in an adversary’s system. 182 Furthermore, after its war 
in Georgia, Russia understood it could no longer depend entirely on conscripts or unfit 
field officers. 183 Russia modernized and professionalized its military to respond and 
mobilize quicker than it had before. These findings, along with a more precise 
synchronization between pro-Russian separatists and Russian military, coordinated with 
media control, cyberspace, and Russian diplomacy, set the tone for Russia’s conflict with 
Ukraine in 2014. 184 

Like Georgia, Ukraine has strong ties to Russia through its shared history, culture, 
and population. In 2001, approximately 17 percent of the Ukrainian people were ethnic 
Russians. 185 Also, because of the Soviet Union’s historical influence on Ukraine, close to 
one-third of Ukraine’s population lists Russian as their first language, and most of the 
community can switch between Russian and Ukrainian effortlessly. After Ukraine got its 
independence in August 1991, political instability followed. As Ukraine was newly 
independent, the structural and organizational frameworks needed to establish an effective 
government were challenged through inexperienced politicians and leadership. 186 An 
economic depression followed, and eventually, the population, which initially was 
unilaterally in favor of independence, fell into a political disequilibrium. To unite the 
people, the successive presidents through the 1990s promised stronger ties to Russia, but 
also looked westward, trying to partner with the United States, NATO, and the European 
Union. 187 After almost ten years as an independent country, Ukraine was not able to 
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improve its situation dramatically, eventually leading to a more authoritarian, corrupt 
regime. 

In 2004, more political instability followed when Prime Minister Viktor 
Yanukovych alleged victory in the Ukrainian presidential election. Major protests erupted 
among Ukrainians claiming the election to be a fraud, eventually leading to the Orange 
Revolution and, in 2005, the pro-West politician Viktor Yukashenko won the presidential 
election in Ukraine. While the people’s Orange Revolution succeeded, the revolution was 
not a popular event in Russia; along with Russo-Ukrainian disputes over natural resources 
and Ukraine’s westward orientation to a NATO membership, Ukraine’s relationship with 
Russia deteriorated. 188 

In November 2013, the now legally elected President Yanukovych decided to halt 
the Ukrainian negotiations with the EU regarding free trade, and instead strengthen the 
relationship and bonds with Russia. A massive demonstration followed, and after three 
months of protests and fights among Ukrainian citizens, political extremists, and the police, 
the amount of violence and number of protest-related deaths forced the president to seek 
agreement with his political opposition on February 21, 2014. 189 For Russia, the outcome 
was the worst possible; Ukraine, one of Russia’s most important neighbors, oriented away 
from Moscow, and a pro-Westem oriented political force was taking control of its 
capital. 190 In its effort to retain control over Ukraine’s strategic orientation—or assure 
Russia’s territorial control over the peninsula if it failed to control the strategic 
orientation—Moscow consequently annexed Crimea. 

The first signs of an open Russian engagement to alter the Ukrainian political order 
appeared February 24, when pro-Russians in Sevastopol established a Russian citizen as a 
mayor, and the Russian Naval Infantry entered the city square in armored personnel carriers 
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(APC). 191 Along with the new mayor, the pro-Russian organizations requested local self- 
defense militias in protection from the Western-oriented government in Kyiv. 192 The 
following morning 200 Spetsnaz operators from the SSO, the elite special unit in Russia, 
infiltrated Crimea and operated in a clandestine pattern under cover of being local self- 
defense militia supporting Russia. Early on the morning of February 27, approximately 50 
SSO operators raided the Crimean Parliament building. To demonstrate its cause, the SSO 
operators hoisted the Russian flag on top of the Ukrainian Parliament building. 193 The 
operators identified themselves as the “Russian-speaking Crimean population’s self- 
defense force.” The occupants appeared in paramilitary clothing without any insignias or 
flags identifying them, and their faces were covered with ski masks. Compared to a local 
militia, however, the soldiers in the Parliament building were extremely well-armed, with 
sniper rifles, machine guns, night vision aid, and grenade launchers. The Parliament 
building was at the time unmanned, and the men took over the building with no resistance. 

The following day, the Crimean prime minister approached the uniformed men in 
the Parliament building, asking them for their rationale and motive. The prime minister 
surrounded the building with law-enforcement officers, and the Ukrainian prosecutor’s 
office claimed the occupation as an act of terrorism. 194 Nonetheless, poorly trained and 
equipped, and with clear orders from the government in Kiev not to escalate the crisis, the 
local Ukrainian forces did not advance. The occupants answered that they would reveal 
their business later; however, at the time asked, they could not explain why they were there 
or what their intentions were. The prime minister reported the situation to Kyiv, for further 
instructions and desired approach. The situation led to confusion and paralysis among 
Ukraine’s national leadership. Afraid of political consequences and Russian reactions to 
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Ukrainian actions, the national leadership in Kyiv ordered the Crimean prime minister to 
wait and specifically ordered the Crimean security forces to “not open fire.” 

Later on February 27, less than a company-sized number of unmarked soldiers 
disabled Ukrainian air power by entering the Belbek airfield and blocking the runway, and 
seized Crimea’s main civilian airport and its air traffic control center in Simferopol. 195 In 
less than an hour, Ukraine lost its air power capabilities in Crimea. The forces seizing the 
facilities were dressed in Russian-issued patterns and weapons but refused to identify 
themselves. As their vehicles also were unmarked, the local Ukrainian armed forces and 
law-enforcement forces became situationally confused and were unable to immediately 
counter them. 

The day before the attack on the Parliament building, Russia maneuvered 150,000 
soldiers to East Crimea under the pretense of a rapid readiness check of its forces, one of 
many Russian rapid military exercises in 2013. 196 The tactical deception worked 
excellently. Before the Ukrainian central government understood the escalation in Crimea, 
Russian forces had established control and seized Simferopol airport, and by doing so, 
established control over the airspace and opened it for Russian air logistics into Crimea. 197 

During the annexation, Russia installed control over the communication in Crimea, 
or more correctly, Russia disabled Crimea’s correspondence with the world. 198 While the 
prime minister initially could communicate with the national authorities by cell phone, 
Ukraine lost its command and control over Crimea after the first week. 199 During the first 
week, armed fighters assumed to be SSO as well, raided the Ukrainian telecommunications 
firm Ukrtelecom’s facilities, and tampered with its fiber optic cables. From that point, 
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Ukraine could not provide a secure or private connection to the peninsula. 200 Furthermore, 
Russia gained access to Ukrainian strategic decisions through cybercriminals’ hacking of 
the Ukrainian Parliament’s cell phones. Also, as in Georgia, several DDoS attacks and 
website defacement attacks on Ukrainian government websites contributed to chaos and 
broke Ukraine’s ability to conduct both unity of command and unity of effort. 201 
Furthermore, the Russian hacking and cyber warfare were also directed at the private sector 
and nonmilitary sections of the Ukrainian government, leading to economic loss for 
Ukrainian companies and lack of political trust among the population. 

While the Russian information campaign targeting Ukraine can be traced back to 
Putin’s Munich speech in 2007, 202 it intensified in 2013 when Russia media started 
manipulating information when covering the riots and protests in Ukraine. 203 Russian 
media initially targeted Ukraine’s population warning about the Western influence and the 
danger of stronger ties to the West. As most of the people of Crimea and Eastern Ukraine 
follow Russian media, Russia had already started influencing the Ukrainians’ mindset and 
attitude. While scholars debate the effect of Russian cyber warfare in Crimea, it 
undoubtedly gave the Russian campaign elbowroom to maneuver during the most critical 
phase of the annexation tactically. The extent of the information campaign’s ability to 
soften the local population’s will to fight back will naturally remain unknown. Yet, as the 
locals did not fight back, a fair conclusion is that they supported the Russian campaign. 

In retrospect, the media coverage displays clear links to the military campaign. As 
the situation progressed and military operations proceeded, the media supported the 
Russian government’s actions before the operations were publicly known. 204 After the 
Ukrainian government’s collapse in February, Russian media intensified the polarization 
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effect of its Ukraine coverage. The main message distributed by Russian media warned 
about the danger for Russians in Ukraine at the same time as it discredited the Ukrainian 
government. The intent was to make the population’s attitude favorable toward Russian 
forces. As an additional part of the influence campaign, the Russian Federal Security 
Service [Federalnaya sluzhba bezopasnoti ] (FSB) and agents from Russia’s military 
intelligence organization [Glavnoye Razvedyvatelnoye Upravlenie ] (GRU) locally 
supported the hearts and minds effort among the Crimean population to secure a pro- 
Russian mindset among the public. 205 

For Ukraine, the loss of communication led to ineffective C2 over its Crimean 
peninsula forces, hindering both the ground forces from reporting their observations that 
would provide central authorities with situational awareness, and the government’s ability 
to task or re-arrange its forces to effectively fight and stop the Russian advancement in 
Crimea. Also, the lack of communication caused the central government not to receive a 
proper early warning of the escalated situation until it was too late. 

During the annexation, Moscow repeatedly denied involvement in Crimea. The 
covertly employed SSO operators, who performed as “little green men” without any 
identification marks, along with the cyber warfare conducted by criminals and “Russian 
patriots,” protected Russia’s plausible deniability in the international arena. During his 
press conference on March 4, President Putin stated that “his country had no plans to annex 
Crimea, and that there were no Russian soldiers on Crimean soil.” 206 Also, the 
cyberattacks, even though tightly coordinated with the ground forces’ advancement, 
originated from proxy forces with no apparent link to the Russian government. 207 
Although the Russian government never affirmed its involvement, the Crimean annexation 
stands as confirmation of the significant effect of centrally incentivized private hackers’ 
contribution to modern conflict. 208 
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Eventually, Russia annexed Crimea without any direct casualties. 209 The hybrid 
approach through information control, along with clandestine special warfare operators as 
local militia, the rapid reaction drills as a deception to cover the mass movement of forces 
and power into Crimea, and the exploitation of a vulnerable Ukraine in a politically 
unstable situation are all important factors that contributed to a highly successful tactical 
performance. Russia demonstrated its ability to bring national leadership’s decisions and 
resolutions into effective actions almost immediately, and both planned and deployed 
forces rapidly. 210 

D. LESSONS IDENTIFIED 

The two conflicts share several common tactical approaches, and in hindsight, one 
may state that Georgia acted as a testing ground and eye-opener for Russia’s central 
leadership, while Ukraine displayed the new and improved version of Russia’s hybrid 
warfare. Ukraine and Georgia historically share similarities with their ties to Russia. Both 
countries have a violent history with Russia and the Soviet Union, fighting for their 
independence and freedom through centuries. 211 After breaking out from the former Soviet 
Union in 1991, both nations also turned westward and had the ultimate goal of becoming 
NATO members, not a popular move from the Kremlin’s perspective. Eventually, the two 
conflicts became the Russian response to the West’s soft power projection eastward. 212 By 
analyzing the two conflicts through a lens of Russian tactical performance, it is possible to 
divide the lessons learned regarding utility and suitability for subsequent and ulterior 
conflicts into two variables: the regional and the non-regional applicability. 
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1. Regional Variables 

The regional factors in both conflicts stand out as variables unique for the given 
conflicts or for areas in the same situation as Georgia and Ukraine were. First and foremost, 
both countries had strong ties to Russia. The shared history, as part of the Soviet Union, 
ties the populations and cultures together regardless of country borders. And by having a 
Russian link, naturally, both nations had a lack of ties to the West, which could have served 
as a deterrent against Russian aggression. Conversely, the historical and cultural bonds 
were beneficial for Russia, as the Russian ethnic minorities in those countries gave room 
for political maneuverability. 213 As minorities of the Georgian and Ukrainian populations 
speak Russian, and some identify as Russian, it provides Russia with an incentive to protect 
Russian minorities and an alibi for Russian aggression. The Kremlin also argues against 
Western interventions in the conflicts as NATO did the same thing in Kosovo some years 
before the Georgian conflict. 

A second regional variable is a weak government and poor economy in both 
Georgia and Ukraine, resulting in both weak military and security forces in general. 214 In 
Georgia, the military forces were poorly equipped and trained and prepared more for 
stability operations in Afghanistan and Iraq than for defending home soil. In Ukraine, 
outdated equipment and lack of training made the Ukrainian military response ineffective. 
Furthermore, as both countries had severe internal security problems and high levels of 
corruption, it increased the operational abilities for maneuvering among the targeted 
organization or location. Corruption enabled infiltration of the security forces like police 
and military, as well as political and administrative structures. 215 Also, Russia benefited 
from an inexperienced Ukrainian government. Whether the Ukrainian response would have 
been more appropriate with a more mature government is debatable; however, it is safe to 
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say that the freshly seated Ukrainian government’s anemic response enabled Russian 
advancement. 

A third regional factor is Russia’s ability to maneuver and advance its military 
forces on Russian soil under the guise of military exercises and drills of Russia’s security 
system. Russia uses exercises as maskirovka for its logistics by deploying a large number 
of forces toward the conflict area as military training and drilling. Even if the Russian 
logistical movements alarm neighboring countries, it is within Russia’s sovereign national 
rights to rehearse its forces, and thereby becomes an effective method for Russia, and hard 
for bordering countries to defend against. 

2. Non-Regional Variables 

By non-regional variables, this study refers to the tactical tools deployed in the two 
conflicts which could also be used elsewhere, regardless of cultural ties or history. 
Chronologically, Russia employed its influence campaign first. The information operations 
did not address the adversary’s population alone, but just as important, also the Russians. 
The Russian 10 campaign started months before the military escalations, when Russia 
warned about the Western influence in the region and the importance of securing Russian 
citizens and patriots. The Russian 10 campaign used not only conventional media but also 
social media as carriers of Moscow’s messages. The Russian information strategy is 
focused on influencing and altering the general perception of a situation to its benefit. 
Russia introduces “options” and straightforward lies in ordinary news and media. 216 

One may state that the influence campaign is a regional variable as both Georgians 
and Ukrainians accessed and enjoyed the Russian press as part of their primary media and 
entertainment sources. In that way, Russia influenced not just its population, but also the 
local population in the conflict areas. Nevertheless, when Russia decided to synchronize 
hybrid threats toward NATO’s most powerful nation, the United States, it revealed not only 
unfamiliar confidence but also that its new hybrid capacity is currently beyond the scope 
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of national and NATO doctrines. 217 During the presidential election won by President 
Trump in 2016, the Kremlin orchestrated several simultaneous and complementary cyber¬ 
attacks on the Democratic National Committee (DNC), the Democratic Congressional 
Campaign Committee (DCCC), and Secretary Hillary Clinton’s campaign. The goal of the 
influence campaign was “to undermine public faith in the U.S. democratic process, 
denigrate Secretary Clinton, and harm her electability and potential presidency.” 218 Russia 
also tried to influence the American population through American technology, in 
particular, social media. Best known is “The Heart of Texas,” an anti-Muslim Facebook 
page, run by Russian cyber-trolls, who aimed to spark hatred against Muslims and thereby 
divide American society. Russia’s usage of hybrid attacks on its non-bordering adversaries 
shows that the hybrid instruments employed do not just have a regional effect, but are also 
effective beyond the regional aspect. 

The United States is not alone as a target of Russian interference in national 
elections; the recent elections in the Netherlands, Germany, and France all have somehow 
been tampered with. 219 In 2017, Russian hackers attacked the French presidential 
candidate Emmanuel Macron by stealing emails and discriminating against him through a 
propaganda campaign alleging Saudi Arabia funded his election campaign and spreading 
rumors about Macron’s sexuality. The cyber-attack showed strategic timing as it hit 48 
hours’ before voting began, when French law forbids candidates from further campaigning. 
Regardless of the outcome and the effectiveness of the attacks, the Russian offensive in 
cyberspace reveals a strategy that dares to aggressively attack the United States and NATO 
countries, in a modern, innovative way. Additionally, Putin blames private hackers for the 
interferences, and thereby maintains Russian deniability through proxy forces. 220 
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Conversely, recent analysis investigating the domestic national processes in Russia reveals 
that cyber-activists attacking Russian targets face a swift and harsh response from Moscow, 
but the FSB 221 does not prosecute when cyber-activists target European and American 
victims, and the Russian government rejects bilateral cooperation with foreign countries 
for such investigations. 222 At a minimum, this reveals passive support to non-state actors 
whose actions benefit the government. In sum, Russia demonstrates its ability to employ 
10 at non-Russian speaking and culturally different populations. 223 

While large parts of the Russian 10 campaign are driven through the cyber domain, 
Russia shows, through the two conflicts examined, its national ability to use cyber to 
accomplish much more than just its 10. In Georgia, the DDoS attacks created tendencies 
to panic among the citizens in Tbilisi and hindered the government to perform effective 
command and control over its forces during the initial phase of the conflict. In Crimea, the 
cyber campaign—along with SOF operations affecting the communication systems—not 
only hindered strategic C2, but it stopped all communication between the Crimean 
Peninsula and the Ukraine mainland and its capital. A control over communication, as such, 
gave Russia the power over which information the citizens of Crimea received and thereby 
softened the local population for Russian operations. Moreover, Russian cyber capabilities 
are not limited to conflicts with former Soviet Union states. Cyber falls under the concept 
of electronic warfare (EW), as part of the warfighting function “fires.” Historically, 
Russia’s EW capability is powerful and sophisticated, and currently, the Russian EW 
capability produces a foundation for worry among Western countries. Also, in Norway, the 
recent Russia-deployed GPS jamming, hindering both military and civilian communication 
systems such as for air traffic control and rescue units in their daily work, demonstrate 
Russia’s ability to impede Western operations as well. 

22 1 FSB: Federalnaja sluzjba bezopasnosti 
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Lastly, the ground forces employed in the two conflicts demonstrate Russia’s 
creative use of power, which does not limit itself to the former Soviet Union region. Both 
the use of SOF units and the use of proxy forces enabled two critical factors for Russia. 
First, the non-military approach presented local authorities with a dilemma in terms of 
situational understanding. Uniformed military forces marked with flags and national 
symbols would rapidly and straightforwardly state a military conflict and mandate military 
responses. Conversely, especially as seen in Crimea, the non-marked “little green men” 
along with “civilians” contributed to confusion and uncertainty. Local authorities in such 
cases must then decide whether they are responding to a military or a civil problem. And 
with no communication or support from central authorities, the local response did not 
match the Russian execution. The blurry distinction between war and peace complicates 
the situational understanding for the local authorities, and thereby, deactivates a normal 
conventional early warning system, using cross-sectoral attacks below the detection 
thresholds . 224 Through its campaigns in Syria, Russia has demonstrated not just its non- 
regional capabilities, but also its ability to employ national SOF capabilities along with 
proxy forces and mercenaries from private military companies (PMC) such as the Wagner 
group and the Turan unit . 225 In opposition to NATO-members’ PMCs, which are mostly 
used for security and training of host nation forces, the Russian PMCs engage in front-line 
fighting in Syria. Russia has thereby confirmed both the national will and capability to 
employ a mixture of military and non-military means to reach its objectives beyond the 
two neighboring conflicts as well, and thus the means present as a non-regional tool. 

E. CONCLUSION 

For Norway, most of the regional factors stated in this chapter are not problematic. 
As a stable democracy with minimal signs of cormption, the Norwegian security system 
inhibits the growth and room for maneuvering by foreign agencies and powers, and thereby 
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the other described regional factors. Norway’s only area for concern regarding the regional 
factors is Svalbard, where there is both a Russian-speaking population and historical 
disputes and disagreements between the two nations. Except from small associations close 
to the border in Finnmark, Norway’s mainland does not have any sizeable Russian- 
speaking population with ties to Russia, so Russia cannot justify any aggression. Of the 
stated regional factors, the only problematic factor for Norway’s mainland is Russia’s 
large-scale military exercises and drills, including rapid movement and forwarding massive 
amounts of troops toward the Norwegian border. 226 Russian maneuvers, as such, have 
recently escalated and provoked debate in Norway, as they demonstrate both Russian 
intentions of presence and control in the Arctic, and a willingness to defy NATO, in order 
to reach its strategic objectives. 227 Russia has recognized the potential to achieve strategic 
goals in multi-domain power projection by probing for weak spots in the gray zone and 
further exploiting weaknesses in its adversaries. 228 

The given non-regional factors alter the traditional operational environment for 
Norway’s defensive mechanisms and security forces, and can, therefore, streamline the 
Russian power projection in a potential future non-article V crisis with Norway. During 
the annexation of Crimea, the Ukrainian forces were superior to the Russian force, both in 
numbers and power. 229 Russia’s critical initial phase lasted several days, but as in Georgia, 
the Ukrainian troops were shocked by the Russian ambush and were never able to regain 
the advantage despite the few Russians present. 230 By the operational advantage of both 
strategic and tactical surprise, along with the ability to both create and utilize Ukrainian 
confusion, Russia gained relative superiority, which enabled enough time and space to 
secure critical infrastructure and room to maneuver for Russia’s main force in the 
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annexation of Crimea. In numbers, Russia incapacitated 2.5 million Ukrainian citizens and 
12 percent of the Ukrainian armed forces, 22,000 men, 231 warships, fighter aircraft and 
artillery, using fewer than 200 SSO operators from the Russian SOF for the first days of 
the annexation. 232 For the Norwegian armed forces, the non-regional variables should be 
taken into consideration in its continuous effort to secure Norway’s borders and 
sovereignty. For NORSOF, the non-regional variables represent alterations in NORSOF’s 
national tactical and operational environment, and should thereby be an essential part of 
NORSOF’s problem framing when analyzing and developing in an effort to remain a 
proficient part of Norway’s security apparatus. 
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IV. NEW OPERATIONAL ENVIRONMENT AND 
DEVELOPMENT 


The bravest are surely those who have the clearest vision of what is before 
them, glory and danger alike, and yet notwithstanding, go out and meet it. 

— Thucydides 

A. INTRODUCTION 

The recent Russian information operations projected at NATO countries did not 
involve a desire for terrain or territory as in Georgia or Ukraine. The threats deployed at 
NATO were conducted to develop and augment chaos and regional instability, and thereby 
impact both national and NATO integrity. By using proxy forces and attacking infrastructure 
and the civilian population’s mindset and opinions, the hybrid threats are blurring the 
distinctions between combatants and civilians. Russia has found a loophole in the NATO 
alliance, as it can attack and interfere with NATO members without robust NATO responses. 
Russia is trying to achieve desired outcomes without the current understanding of war by 
attacking different adversaries’ society, rather than their respective military forces. This 
study’s goal is to visualize the operational environment for the Norwegian security apparatus 
and NORSOF if the current Russian power projection toward Norway evolves from hybrid 
threats seeking to affect Norway’s integrity and create national instability, to the employment 
of forces trying to gain political objectives without escalating over the threshold of a NATO 
Article V situation. Russia is not afraid of repeating its new hybrid threats toward the West. 
The current projection from Russia shows at least one of two things: Russia is using its 
adversaries as a testing ground to develop and refine its new strategy, or Russian strategic 
analysis shows precisely the results the Kremlin desires. Nevertheless, as long as Russia 
views NATO as an adversary, Russia will provide its security, most adequately at present, 
through hybrid threats. 

Whether or not Russia achieved its strategic objectives in Georgia and Crimea is 
debated; however, as this thesis shows, its initial tactical approach was smart, innovative, 
and effective, especially in Crimea. This chapter mainly focuses on the non-regional features 
of Russia’s new tactical approach and analyzes how the tactics affect the operational 
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environment. The following section explains the findings and how they can hinder a 
Norwegian response, with the intent to describe what NORSOF should expect and prepare 
for in case of a national crisis with Russia. As visualized by Figure 14, the thesis aims to 
learn from allied efforts taken in similar challenges and generate options for NORSOF to 
improve its potential output as a national hybrid countermeasure. This thesis also introduces 
lessons learned and efforts taken in Finland, the Netherlands and Germany. 


Analyze the problem 
between Russia and 
Norway 


Understand the 

challenges of hybrid 
threats and warfare 



This chapter merges the two remaining parts of the thesis design process, by including lessons 
learned from allied SOF to propose NORSOF options. 

Figure 14. NORSOF adjustments to face the new operational 
environment more effectively 

By analyzing the non-regional factors, this study finds three distinct features that 
drive the Russian tactical success and that NORSOF should consider and implement in its 
mission analysis. The three features are tactical cross-sectoral conflict, a need for rapid 
response, and the situational and communications complexity Russia successfully exploits 
to gain the advantage in conflicts. NORSOF can learn from allied nations how to engage the 
three described features driving the operational environment. Even though the lessons 
learned do not all represent conflicts with Russia, they describe how other nations’ SOF have 
successfully developed organizationally to address one or more of the three features 
described. 
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The findings challenge traditional military defense theories and conventional 
methods to secure national sovereignty and integrity. Notably, the political sensitivity and 
the risk of escalation complicate the situation and the potential for an international crisis. 
Hybrid threats take advantage of this sensitivity, which means that from the defending side, 
it should be handled, not avoided. Due to hybrid warfare’s use of proxy forces and its 
plausible deniability, hybrid scenarios are difficult to attribute as to origin. On the other hand, 
the lack of attribution may also be hybrid warfare’s weakness as the national reactions 
become means to fight rebellions or insurgencies. Thus, the countermeasures taken do not 
trigger military reactions to a national countermeasure taken without escalating into a 
military conflict that engages NATO’s Article V. 

For Norway, this promotes NORSOF and its role as a low-profile interdepartmental 
countermeasure. The national authorities’ apprehension of a tactical employment’s strategic 
effect derives from the presumed consequences of the tactical actions conducted. 233 This 
means that Norway’s hybrid countermeasures—at least its initial response—should be 
designed intentionally to be potent during a low-profile posture. A description as such is 
synonymous with one of the characteristics of special operations: 

Special operations are missions to accomplish strategic objectives where the 
use of conventional forces would create unacceptable risks due to 
Clausewitzian friction. Overcoming these risks requires special operations 
forces that directly address the ultimate sources of friction through qualities 
that are the result of the distribution of the attributes of SOF personnel. 234 

Thus, the modest footprint of NOROSOF’s actions—along with its multidisciplinary 
capability—becomes a significant component when analyzing how to counter hybrid warfare 
and at the same time limit the consequences’ potential range and scope. 

Additionally, hybrid warfare’s described utilization of plausible deniability as an 
enabler for maneuver makes attribution an essential part of the defending side’s 
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countermeasures. Attributing gray zone actions to a nation’s agenda or power projection 
becomes critical to leverage the national means of reaction. Alternatively, the lack of 
attribution makes the hybrid threats remain a criminal activity only, which will not be 
handled appropriately as an international affair. Through its effort in international NATO 
campaigns, NORSOF has developed experience and knowledge of attribution relevant to the 
process of finding arrest warranted personnel who are hard to both detect and identify. In 
NATO, this process, find-fix-finish-exploit-analyze-disseminate (F3EAD), is part of the 
process of finding terrorists and is the current knowledge that may come in handy for a 
smaller local police force in Norway. NORSOF’s F3EAD experience establishes a 
foundation for similar operations and brings expertise and capability to attribute actions to 
the source of dispatch. A national Norwegian joint force designed to fight hybrid scenarios, 
led by the police, supported by NORSOF, will represent a responsive countermeasure to 
similar threats in a gray zone crisis. 

B. CROSS-SECTORAL CONFLICT 

Norway’s current sector-oriented security apparatus is not oriented to face hybrid 
scenarios. Frank Hoffman stated in 2007 that “defeating the hybrid adversary will require 
alterations in how military and national security organizations think about strategy and how 
leaders are educated.” 235 For NORSOF, this means that as the problem framing defines 
threats intentionally as being cross-sectoral, the development of interdepartmental 
cooperation at all levels will be highly relevant for NORSOF’s hybrid warfare 
countermeasures in the future. Hence, tactical capabilities and superior soldier skills are 
important, but not adequate as a countermeasure against hybrid warfare. The ability to 
cooperate and communicate with other organizations becomes essential, as in the concept of 
being a warrior-diplomat, a term used for modem special operations operators. 236 The 
warrior-diplomat utilizes “highly developed social skills,” empathy, and is a “well-educated 
enabler who thinks strategically and can develop SOF capabilities into a comprehensive 
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whole-of-government approach creatively.” 237 On the tactical level, interagency 
understanding is not a new concept for NORSOF. As recent international missions have been 
of an MA nature, both MA to local militia and police forces, NORSOF operators have the 
experience of cultural patience, as well as an understanding of the tactical importance of 
cultural and personal bonding to improve battle power. In other words, the international 
experience is applicable and relevant in the interdepartmental effort to enhance national 
security. 238 

The blurred situation inevitably creates hesitancy and, thereby, vulnerability. The use 
of unidentified soldiers or soldiers disguised as civilians enables strategically important 
plausible deniability for Russia, but it is also vital to Russia gaining tactical success, as it 
hinders the apparent hallmarks of military conflict and thereby cripples an automatic military 
response by the ambushed nation. 239 When presenting as a military effort, it is debatable 
about how to respond accurately. Furthermore, if the soldiers are not even dressed in military 
clothing, but present as civilians, it blurs the situation even more. A fighting force hiding 
among civilians and blending in with the local population is hard to detect and engage. This 
means that the adversary’s activity and work can be hard to identify. Despite Norway’s 
knowledge of an adversary’s business on Norwegian soil, it remains unknown who the forces 
are and what work is being done. Accordingly, the Ukrainian government’s initial reaction 
was rational, and Russia understood how to exploit it. 240 The Ukrainian desire not to escalate 
any delicate political situation between Ukraine and Russia in Crimea enabled Russian forces 
to execute their mission and reach their tactical objectives without Ukrainian forces 
producing any noteworthy resistance. While the central government in Kyiv was still able to 
communicate with local governments, Ukrainian central leadership explicitly ordered the 
local security apparatus in Crimea not to provoke the situation. The local forces in Crimea 
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obeyed the order. If the Crimean authorities had disobeyed and escalated the situation, it is 
difficult to predict whether Russia then would have “supported” Russians as in Georgia or 
let the situation end in a diplomatic feud. However, as the unmarked soldiers seizing the 
Parliament building in Crimea were the SSO—the best trained and equipped soldiers in 
Russia—the local police and security apparatus in Crimea would have probably met strong 
opposition if they had disobeyed the governmental order and escalated and provoked the 
occupants. 

The Norwegian security sector should learn from the situation, as the Ukrainian 
reaction during the initial phase in Crimea is—in a realistic perspective—a small-state 
response to a larger adversary, similar to the desire not to escalate the situation in the Barents 
Sea 2005. 241 The Russian forces in Crimea were dressed and equipped as soldiers, though 
unmarked; however, that is not necessarily how it will present in a future situation. As Russia 
demonstrates no reluctance about using proxy forces and camouflaging soldiers among 
civilians, a future power projection may masquerade as fishermen, as the local population on 
Svalbard, or as criminals in Norway. Such a situation displays naturally as a civil affair and 
a matter for the Norwegian police. As the Norwegian police in the peripheral districts are 
limited in resources, however, the threshold for mobilizing the NORSOF should lessen. This 
finding calls for increased cooperation between the police and NORSOF. Yet, to lower the 
threshold for collaboration and increase cross-sectoral communication, mutual and collective 
knowledge and understanding of both sides’ organizational structure and capabilities is vital 
in building respect and breaking down biases. 242 Thus, NORSOF must organize cross- 
sectoral partnerships and interagency abilities before a crisis emerges. 

By engaging in interdepartmental relations, NORSOF strengthens Norway’s footing 
in a future hybrid scenario. For any security organization to handle stress and situational 
unknowns, the organization needs to possess three features: professional expertise, diversity, 
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and creativity. 243 To possess professional expertise, the organization must exercise together 
to understand its capabilities and potential effects. Diversity enables the organization to 
embrace a broader spectrum of challenges. Organizational creativity—a key feature— 
enables improvisation when unknown factors do arise. In total—as SOFs are defined by 
attributes such as creativity, professional expertise, and out-of-the-box mindset—the three 
features affirm NORSOF’s strengthening role in a task organization countering hybrid 
threats. 244 

1. Finland 

By studying how Finland is already managing similar gray zone problems and 
challenges, Norway can improve its cross-sectoral cooperation. As a member of the 
European Union, but with no membership in NATO, Finland holds an important geostrategic 
position for the Western world, with its shared border and history with Russia. Finland’s 
annual defense report from 2017 reveals that the early-warning time for a national crisis has 
decreased, and the Finnish society’s vulnerability has increased, because of an internationally 
lowered threshold for using force. Furthermore, Finland’s national security assessment from 
2018 revolves around hybrid challenges and hybrid tools such as disruption, influence, and 
terrorism. The assessment states that “the Security Strategy for Society specifies hybrid 
influencing as action in which the instigator aims to achieve its aims by using a multitude of 
complementary methods and exploiting the weaknesses of the targeted community.” 245 

Finland, as a nation, has accepted that hybrid threats exploit artificial cross-sectoral 
borders, and prepares accordingly. 246 Not just inter-govemmental and inter-agencies, but 
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Finland’s business communities and the civilian society are collaborating on security because 
of a shared understanding of the threats and potential damage. Cooperation in a whole of 
government and whole of nation perspective stands as a matter of utmost importance and 
necessitates a comprehensive national strategy: 

It is now essential to adopt a broader and deeper understanding of private- 
sector security involvement. There are numerous examples of the ways in 
which the private sector has become deeply involved in providing security 
against diverse, complex and often transnational security risks. They are not 
only protecting the vital functions of society, private companies are also 
taking care of border security and emergency preparedness, for example. The 
armed forces have also become increasingly dependent on infrastructure and 
assets in the private sector. 247 

In Finland, the military special operations forces (FINS OF) have supported the 
Finnish police for several years, and Finland’s national leadership is actively trying to 
improve the cooperation. To enhance the military support to the police, several collaborative 
actions have been taken in recent years: 

Most importantly, the military FINSOF and the Finnish police SOF conduct several 
exercises together annually. The exercises foster lessons learned to improve cooperation 
between the police and the military. One lesson learned was to implement and integrate a 
joint command, control, communication, and computer information system (C4IS) called 
“National Authority Communication System” (NACS). The NACS empowers the police and 
military to communicate on an operational level as well as tactically and enables a shared 
situational awareness (SA) for all units participating in the operation. Finland Defense Forces 
(FDF), who are trained and responsible for hostile attacks during a national crisis, regularly 
exercise along with the police and the Finnish Border Guard (FBG) as part of the Finnish 
total defense concept. 248 The FBG is paramilitary, typically subordinated under the Finnish 
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Ministry of Interior (MOI); however, during a national crisis or times other than peace, the 
FBG will be organized as a part of FDF. To prepare for a crisis, the border guards are trained 
in SOF activities and reconnaissance to be better primed for a rapid escalation. 249 

On June 5,' 2019, operational leaders from the Finnish Police SOF and Finnish 
military SOF explained in interviews how the Finnish MOI had preferred several times to 
deploy the military and Finnish cooperation against hybrid threats: In September 2018, the 
Finnish government executed an operation in which 400 Finnish police officers raided 
buildings and islands owned by a Russian billionaire. 250 The Finnish government accused 
the Russian billionaire of facilitating a Russian forwarded military base in Finland and 
demonstrated national resolve by deploying 400 police officers to the areas of interest. Such 
a large number of police officers indicates a potentially formidable threat assessment had 
occurred before the police raid. As the assault force needed support for naval mobility, the 
Finnish Coast Guard’s boats and crew inserted the Finnish police officers responsible for the 
raid. 

On December 21, 2011, the cargo ship M/S Thor Liberty sailed from Germany to 
Asia, with 69 Patriot surface-to-air missiles to South Korea and 160 tons of high explosives 
marked as fireworks to China. 251 On its way, it stopped by the port of Kotka, a harbor city 
in the South East of Finland. The shipment itself was not illegal, according to German 
authorities; however, the improper labeling and documentation, along with the lack of 
information given to the Finnish government made Finnish customs request support from 
FDF. After the request for support was acknowledged, FDF decided to support Finnish 
customs with FINSOF along with several FDF capabilities. The FINSOF tactical units 
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6343443/Commando-raids-Finnish-islands-spark-fears-used-secret-Russian-mili tary-bases.html. 

25 1 “Finland Probes Ship Full of Patriot Missiles & Explosives Bound for Shanghai,” The Maritime 
Executive, accessed July 30, 2019, https://www.maritime-executive.com/article/finland-probes-ship-full- 
of-patriot-missiles-explosives-bound-for-shanghai; “Finland ‘finds Patriot Missiles’ on China-Bound 
Ship,” BBC News, December 21, 2011, https://www.bbc.com/news/world-europe-16292244. 
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supported the customs personnel in Kotka to secure the movement of the missiles, and in 
doing so enable other FDF capabilities to confiscate the explosives. Eventually, the Border 
Guard unit placed the ship under arrest until further investigation was conducted. 

The two examples demonstrate both national resolve and cross-sectional 
maneuverability in Finland’s national security apparatus. The second example, where 
FINSOF supported the local customs in Kotka, is not a hybrid problem; however, it displays 
a flexible and responsive reaction system ready to assist when needed. The systemic 
understanding of hybrid problem framing at all national levels enables Finland’s whole of 
government approach, and demonstrates a national will and resolve to break down cultural 
barriers between sectors. The multiple training and exercises conducted annually is one of 
the keys for cross-sectoral cooperation in Finland. By exercising together, the different forces 
learn and develop in a step-by-step process, and can test and retest the lessons identified and 
thereby convert the knowledge to a lesson learned system-wide. The outcome is better C2, 
strengthened interdepartmental communication, and improved response time when the 
situation calls for local cooperation among the different organizations of Finland’s security 
apparatus. 

2. The Netherlands 

In the Netherlands, cross-sectoral cooperation and organizational flexibility are 
fundamentals in the national efforts to fight terrorism. After the Munich massacre during the 
summer Olympics in West Germany in 1972, when the Palestinian terrorist group Black 
September killed eleven Israeli athletes after taking them hostage, the Dutch government 
wanted specially designed and trained forces for its national counterterrorism efforts. 252 
Learning from the incident, the government in the Netherlands proactively implemented its 
Marine special operations forces (MARSOF) as the responsible CT unit in the Netherlands. 
Initially, it was a paper-force more than a useful measure, as it remained untested. In 2004, 
after the murder of the moviemaker Theo van Gogh and a 14-hour house-siege in The Hague 
by the terrorist group “The Hofstad Group,” an investigation led to a report revealing areas 

252 Gerard van Oosbree, “Unit Interventie Mariniers [Marine Intervention Unit],” Dutch Defence 
Press, March 17, 2012, https://www.dutchdefencepress.com/unit-interventie-mariniers/. 
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for improving the Dutch national CT efforts. The report was especially critical of the 
cooperation between the police and the military, noting that the police were not capable of 
CT operations, while MARSOF remained unused. In 2006, as a consequence of the 
organizational investigation, the Dutch government established the Dienst Speciale 
Interventies (DSI) to face its national terrorism threats more adequately. 253 As visualized by 
Figure 15, the DSI is a Dutch police counterterrorism unit, supported by the MARSOF in 
cross-sectoral cooperation. 254 Thus, the DSI commander will always be a police officer, and 
the organization works under Dutch police law. 



Figure 15. A simplified version of DSI’s organizational structure 


253 Noventas, “Terrorist Attack in the Netherlands? Who Will Take Action?,” Current Defense News 
and Messages, Noventas, November 27, 2012, https://noventas.mobi/index.php/tag/m-squadron-marsof/; 
Andy Kraag, “Forging Netherlands Maritime Special Operations Forces” (Master’s Thesis, Monterey, 
California, Naval Postgraduate School, 2012), 2-7, https://calhoun.nps.edu/bitstream/handle/10945/7371/ 

12Jun_Kraag.pdf?sequence= 1 &is Allowed=y. 

254 Korps Mariniers, “Dienst Speciale Interventies (DSI - uitleg [Special Interventions Service (DSI 
explained],” Mariniers-qpo!, August 2006, http://www.mariniers-qpo.nl/nl-marsof-special-forces/dienst- 
speciale-interventies-dsi-uitleg/. 
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The DSI command section is located in The Hague, though its CT units are spread 
across the Netherlands, in three different tiers, working as rapid reaction teams. The first 
tier—the SWAT teams—consists strictly of police officers. The SWAT teams therefore 
conduct regular police work as well as support arrests and investigations. The second tier 
consists of teams, two-thirds of which are MARSOF operators and one third consists of 
police officers. The second tier group works under the title Unit Intervention (AI). The AI 
teams deploy across the Netherlands. MARSOF operators, however, are only allowed to 
engage in CT, and are not allowed to conduct regular police work such as arrests or 
investigation. The third tier group of the DSI CT team structure is the Unit Intervention 
Mariners (UIM), which is the MARSOF’s M Squadron, and consists only of operators from 
MARSOF. The M Squadron’s purpose is domestic CT operations only. In their daily work, 
the AI and UIM rotate between the different teams and levels of readiness; however, during 
a terrorist attack, they will all be called in and engaged. In the case of a terrorist threat, the 
DSI has several small teams spread out across the country to provide support, with the M 
squadron as the last resort in case of emergency. While not created as a hybrid threat or 
hybrid warfare response, the Dutch CT response system demonstrates the capability to 
engage police and military in cooperation to secure national interests. The Dutch police still 
“own” the situation and can withdraw military assistance if necessary, and at the same time, 
enable the police forces to increase their potential and strength when needed. 

Trust is a crucial factor for DSI cross-sectoral cooperation and responsiveness. To 
enhance trust among its ground forces, the DSI teams train and operate together frequently. 
The DSI ground forces are also equipped and uniformed equally, with no distinction between 
the military and the police. This unity of command and personal knowledge enables 
operational trust between the military and the police cultures. 

3. Discussion 

One of the critical findings for successful cross-sectoral cooperation in both Finland 
and the Netherlands is interdepartmental trust at all levels. The trust builds on repeated 
rehearsals and repeated efforts of working together. The common knowledge builds both 
trust in the competence and cultural understanding between the involved organizations, 
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accelerating the efforts during times of crisis. Through trust-building work, along with a 
shared unity of effort mindset, Finland and the Netherlands enhance national security by 
cross-sectoral cooperation. 

Small nations with limited resources benefit from effective collaboration between the 
police and military forces. 255 For Norway, this means that NORSOF should be engaged 
more broadly and more often in work with other structures of the Norwegian security sector. 
By mandating NORSOF to establish a cross-sectoral partnership, ahead of a crisis, Norway 
will enable the fundamental needed trust among the involved forces if a crisis emerges. 256 
The 2005 Barents Sea situation reveals the potential for improvement between the civil and 
defense sectors in Norway. At the tactical level, the Governor of Svalbard [Sysselmannen] 
rejected any support from the offered NORSOF task group and eventually ordered that 
NORSOF operators approaching the situation must be unarmed. In support of the governor, 
the CoP in Tromsp denied permission for the armed forces helicopters to refuel at Bj0m0ya, 
which effectually grounded the helicopters. The reason behind the governor’s rejection of 
support remains speculative, but the situation demonstrates a lack of trust and understanding 
between the available resources. If the governor in advance of the situation had personal 
relations with the NORSOF leadership as well as knowledge of NORSOF’s capabilities, he 
might not have been as reluctant to consider alternatives. While the police—or the governor 
in Svalbard in this case—is the “owner” of the situation and the local CoP remains in control 
and command over the local response, NORSOF enhances the police’s potential in power 
and size, as well as enables capabilities the police in Norway do not usually possess. 

While the police-defense collaboration shows room for improvement, there are other 
important actors for NORSOF to engage as well. In a crisis no longer of a civil matter, and 
where communication with central authorities is hindered, the county governor is in charge 


255 Engebretsen-Skaret, “Bruk av norske spesialstyrker i krisehandtering - utfordringer og muligheter 
[The Use of Norwegian Special Operations Forces During Crisis Management - Challenges and 
Opportunities],'’ 55. 

256 Berg-Knutsen, “From Tactical Champions to Grand Strategy Enablers: The Future of Small-Nation 
SOF in Counter-Hybrid Warfare,” 67. 
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of crisis management. 257 This means that in a hybrid scenario, where the lines of 
communication are compromised or disrupted, and the local authorities are not able to 
communicate and coordinate through Norway’s central leadership, the county governor 
becomes the senior decision-maker in the scenario, and is further responsible for guarding 
the interests of Norwegian society. Furthermore, one of the county governor’s daily duties is 
to locally unify and coordinate cross-sectoral efforts in the governor’s area of 
responsibility. 258 This includes how to synchronize military support with the civilian efforts. 
Usually, however, the county governor is in charge of the governmental policies producing 
a local effect, and as crises rarely emerge, it is safe to state that military special operations 
capabilities are not the main priority at the county governor’s office. Thus, in total, NORSOF 
has a responsibility to educate and enlighten the different authorities, including the county 
governors, of their options and what capabilities NORSOF may have available before any 
crisis emerges (see Figure 16). 


257 Justis og Politidepartmentet, “Instruks for samfunnssikkerhets- og beredskapsarbeidet til 
Fylkesmannen og Sysselmannen pa Svalbard | Instructions for the Social Security and Emergency 
Preparations of the County Governor and the Governor of Svalbard],” Lovdata.no, April 2008, secs. VI-5, 
https: //lovdata. no/dokument/LTI/forskrift/2008-04-18-388. 

258 Kommunal- og moderniseringsdepartmentet, “Utredning Av Fylkesmannens Fremtidige Struktur 
[Study of the County Governor’s Future Structure]” (Oslo, Norway: Kommunal- og 
moderniseringdepartmentet [The Ministry of Municipalities and Modernization], December 21, 2016), 3, 
https://www.regjeringen.no/contentassets/ab581b4bc49442d8b519a82b59d7f068/ 
utredning_av_fylkesmannens_fremtidige_struktur.pdf. 
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Figure 16. NORSOF liaison element to engage in cross-sectoral 
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The responsibility to educate and enlighten the different parts of Norway’s security 
apparatus calls for a fixed NORSOF liaison element (Figure 16). One of Norway’s four 
principles for crisis management states such a requirement: 

The collaboration principle requires that the authority, business or agency 
has an independent responsibility for ensuring the best possible cooperation 
with relevant actors and businesses in the work on prevention, preparedness 
and crisis management. 259 

The liaison element’s purpose includes educating the crisis management entities on 
NORSOF’s capabilities and resources, and breaking down biases and misunderstandings. 
The Norwegian special operations command (NORSOCOM) usually establishes a liaison 
element attached to important decision-makers during national exercises and if a national 
crisis emerges. Nevertheless, an ad-hoc solution as such is not effective or potent enough 
to enable NORSOF as a capacity. 260 To evolve and augment NORSOF’s national 


259 Ministry of Defense and Ministry of Justice and Public Security (of Norway ), St0tte og samarbeid, 
En beskrivelse av totalforsvaret i dag [Support and Cooperation, a Description of the Current Total 
Defense], 18. 

260 Engebretsen-Skaret, “Bruk av norske spesialstyrker i krisehandtering - utfordringer og muligheter 
[The Use of Norwegian Special Operations Forces During Crisis Management - Challenges and 
Opportunities],” 62. 
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potential, as well as enhance interdepartmental trust, NORSOCOM must continuously 
work with the different departments and decision-makers (see Figure 17). Through regular 
meetings and briefings, the liaison element can boost the understanding of NORSOF’s 
capabilities. 
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Figure 17. Formal and desired informal lines of communication 
enhancing NORSOF support to local authorities 261 


As displayed in Figure 17, a NORSOCOM liaison element’s purpose is to engage 
decision-makers on both the operational and—even more critical—the tactical level in the 
police, and, as described, the liaison element should include the county governor. 262 
Naturally, such an assignment is a significant job and needs full-time attention to be 
effective. By means of its NORSOCOM liaison element, NORSOF will start the vital 
networking process of building trust and knowledge among local decision-makers and 


261 Adapted from: Forsvarsdepartementet, NOU 2016:19, 33. 

262 Berg-Knutsen and Roberts, Strategic Design for NORSOF 2025, 36. 
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thereby enhance local authorities’ understanding of NORSOF’s resources and available 
capabilities. In general, John Arquilla’s statement, “it takes a network to fight a network,” 
is still accurate. 263 

Further, it is important to consider that local leadership’s knowledge about 
NORSOF may be biased or incorrect. As part of the concept of operational security, 
NORSOF’s capabilities are confidential. Consequently, the lack of operational 
understanding of NORSOF outside of the NORSOCOM umbrella remains a challenge in 
Norway. 264 Over the last decades, NORSOF units have built an image of being a forceful 
offensive assault capacity through public demonstrations for the media and national 
politicians. 265 While effective as a tool for demonstrating its potential, the given 
illustrations, and thereby the understanding of NORSOF’s nature, may be disadvantageous 
for cooperation with the civilian sector. If the police’s and local leadership’s knowledge 
and understanding of NORSOF’s capabilities is limited to the demonstrations given, the 
governor of Svalbard’s response in the 2005 Barents Sea situation is rational. As political 
sensitivity was already stressed, local leadership did not willingly introduce a fierce assault 
force. This aggressive bias perceived from the public demonstrations may hinder effective 
cooperation, and further validates the need for a liaison element to explain NORSOF’s 
capabilities and potential under “civilized” circumstances. 

Figure 17 presents NORSOCOM’s liaison element to engage multiple 
organizations and in several sectors. Openness and exposure commonly stand in contrast 
to SOF culture and history, as SOF identity often is tied to secrecy. 266 Yet, to make 
decision-makers aware of NORSOF’s tactical options and possibilities, openness, as 

263 John Arquilla and David Ronfeldt, “The Advent of Netwar:,” Product Page, 1996, 82, 
https ://w ww.rand. org/pubs/monograph_reports/MR789. html. 

264 Engebretsen-Skaret, “Bmk av norske spesialstyrker i krisehandtering - utfordringer og muligheter 
[The Use of Norwegian Special Operations Forces During Crisis Management - Challenges and 
Opportunities],” 62. 

265 Forsvaret, Norwegian Special Forces (FSK/HJK, MJK) (Norway, 2014), 

https://www.youtube.com/watch?v=V90r4KJOPIE; Forsvaret, Norwegian Special Forces (MJK, FSK), 
2014, https://www.youtube.com/watch?v=GGrCweoQ_zA. 

266 William H. McRaven, Spec Ops: Case Studies in Special Operations Warfare: Theory and 
Practice (New York, NY: Presidio Press, 1996), 14-15; North Atlantic Treaty Organization, AJP-3.5, 
LEX3-4. 
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described, is necessary. Research shows that leaders under stressful circumstances act 
conservatively and tend to choose familiar and established solutions when challenged with 
an unknown threat. 267 If NORSOF remains unfamiliar to or misunderstood by the tactical 
authorities when a crisis emerges, the natural consequence is for NORSOF’s full potential 
to remain in the shadows, untapped, and absent from supporting Norway’s crisis 
management. By offering its knowledge and potential through briefings before any crisis 
occurs, NORSOCOM enables local leadership to include NORSOF in its tactical toolbox 
in future situations. 

NORSOF’s liaison element must, therefore, include both SOF personnel from the 
operational and the tactical elements. Since NORSOF enables tactical capabilities and 
enhances local power, tactical experts must take part in discussions as they know the crucial 
details the police officers at tactical level both understand and need to know. As the local 
decision-makers are tactical operators as well, the detailed level of information regarding 
capacities is vital to enhance their understanding and bilateral trust. If the NORSOCOM 
liaison element consists of operational level officers only, the liaison element would most 
likely be unable to explain details about procedures, possibilities, and limitations of 
equipment and further specifics needed to operate together effectively. Such details are 
vital to gain the needed bilateral understanding and organizational trust. Thus, tactical 
expertise from NORSOF units’ specialist corps is a significant factor of influence for the 
liaison element to properly serve its purpose. This way, the NORSOF liaison element 
enables local leadership’s critical and detailed tactical understanding of NORSOF 
simultaneously as it breaks down biases and misunderstandings that hinder requests for 
support in a potential crisis. 

NORSOCOM’s liaison element should also include a police officer. When 
NORSOF units deploy to foreign military campaigns, a natural aspect of the operation 
comprises interpreters, not just for understanding the language, but also for cultural 
guidance and support when operating with and alongside local forces and the local 


267 Dave Grossman and Loren W. Christensen, On Combat, The Psychology and Physiology of 
Deadly Conflict in War and in Peace , 3rd edition (Millstadt, IL: Warrior Science Publications, 2008), 34- 
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population. Cultural misunderstandings and well-intended gestures may create undesired 
friction leading to poor cooperation and sometimes unwillingness among partner forces. 
Therefore, the interpreters are not just translators but mandated to share their opinions if 
witnessing cultural obstacles. Furthermore, when establishing a NORSOF task force or 
group, it is normal to implement a liaison to support the communication with joint branches 
or services. For example, a fighter pilot with knowledge of the SOF community will have 
a better basis to function as an air force liaison. The fighter pilot knows the air force culture, 
the “tribe” language, and the norms unfamiliar to someone who has never worked outside 
of the SOF community. Thus, when establishing a liaison element to work with the police, 
it is vital to include someone who understands the daily life and norms inside the tactical 
police units in Norway. By doing so, NORSOCOM’s cross-sectoral liaison element 
enhances its abilities to communicate with and understand its desired partners among the 
Norwegian police force. 

C. THE NEED FOR RAPID RESPONSE 

“Nothing is more difficult, and therefore more precious, than to be able to 

decide.” —Napoleon Bonaparte 

Avoiding conflictual escalation may not be the proper response to a hybrid scenario. 
Research indicates that the Russian annexation of Crimea was a hasty operation and not 
very well planned from the strategic level. 268 A week before the Russian invasion, no 
indicators revealed any Russian escalation; on the contrary, in Crimea, the Ukrainian 
military forces stood on an elevated state of alert due to the chaotic situation in Kyiv. 269 
The initial phase, which involved approximately 50 covert special operators who seized 
the Parliament building, probably was a test from the Russian government. If SSO 
operators were stopped or struck down, Russia could still claim plausible deniability 
without significant political consequences. Unfortunately, as the Ukrainian security forces 
reacted anemically so as not to create more instability, Russia was able to execute their 
next phase unambiguously. This finding illustrates that Russia effectively prods for weak 


268 Lavrov, “Russian Again: The Military Operation for Crimea,” 159. 
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spots and employs a rather opportunistic strategic approach. In contrast to the two episodes 
from 2005 in the Barents Sea, in the light of realism, the less powerful nation’s 
governmental reluctance to act due to concern about political consequences is natural as 
“the fear of triggering a military spiraling with the Russians is a clear motivating factor.” 270 
In the Barents Sea, the situation eased off and returned to normal. In Ukraine, however, the 
reluctance gave Russia the elbowroom needed to execute the next phase of the conflict. 
From the Russian view, the lesson identified, especially in Crimea, is to create enough 
political obscurity through deceptive non-military means so that the proper response is 
unclear. 271 If the initial 50 special warfare operators were identifiable as Russian military 
forces, the Ukrainian response would probably be a rapid reaction overpowering the 
invaders effectively. As the threat’s origin was covert, however, the response came slowly, 
and eventually, too late. 

Russia’s hybrid attack on Crimea seemingly lacked a strategic concept. While the 
initial Russian tactical maneuvering was done effectively and well, the overall plan seemed 
to lack the following phase and concept of operation. For instance, Russia had no clear 
political plan or concept after annexing Crimea, which led to local confusion in Crimea 
regarding which political entity was in charge of the peninsula. This finding indicates that 
Russia’s effort and planning was only successful on a tactical and operational level, while 
unsuccessful at the strategic and political levels, and signals the need for a sense of critical 
urgency for a rapid response during a Russian hybrid engagement. By advancing and 
employing national resources rather than a local response force, instead of avoiding 
political instability and international escalation, the weaker state will break down the 
aggressor’s opportunity to freely advance, both operationally and logistically, into the next 
planned phase in the conflict. 

A significant difference between the situation in Crimea and a potential crisis in 
Norway is Norway’s NATO membership. While Norway does not want to escalate a crisis 
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with Russia, it is also safe to say that Russia does not want to escalate into a military 
conflict with Norway. The plausible Russian deniability may be turned to an advantage for 
Norway if handled appropriately. By rapidly responding to the threat, Norway forces the 
Russian leadership to choose one of two alternatives: one, the Russians may support their 
forces and admit the Russian aggression and thereby potentially escalate the situation into 
an Article V scenario; or, two, maintain their plausible deniability, and thus make the 
potential crisis into a diplomatic dispute and thereby deescalate the situation. 

In total, a rapid response is of utmost importance to fight a hybrid attack. By 
forwarding NORSOF into a gray zone crisis, ready to employ if needed, Norway will have 
a much greater potential to act if the situation escalates rather than reacting after the 
escalation. By rapidly task-organizing and deploying to the local situation, NORSOF also 
presents easy access to advanced technology for the local chief of police. 272 By doing so, 
NORSOF enables capacities to the CoP as intelligence, surveillance, and reconnaissance 
(ISR) support from the air, unconventional technology, and advanced medical capabilities. 
NORSOF also allows the CoP to operate successfully in unforgiving environments such as 
the Arctic climate and subsurface environments one cannot expect the police to be trained 
and prepared for. Also, as a forwarded military response enables more capacity to the local 
situation, their local enhanced team has a better capability to discover and unveil the 
opposing force’s purpose. 

For NORSOF, the need for a rapid response means that its personnel and 
operational equipment must be prepared and packed on high readiness, as well as the 
request process from the police force should be as streamlined as possible. Combined, these 
two factors empower NORSOF to forward its tactical units to the desired position rapidly. 
Furthermore, it is equally crucial that the police’s request for support does not halt or get 
delayed due to misunderstandings or local unfamiliarity with the resources available. 
Consequently, the police’s knowledge and understanding of NORSOF becomes critical to 
facilitate a rapid response to hybrid threats. 
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1 . 


Finland 


The Gulf of Finland is Russia’s most natural sea line of communication to the Baltic 
Sea and further to Western Europe, and over the last six years, the tension in the Baltic Sea 
has dramatically increased. 273 One of Finland’s responses to the increased tension in the 
Baltics, along with the lesson learned from the annexation of Crimea in 2014, was a 
reflection on and revision of Finland’s security system and Finland Defense Forces. 274 
Finland learned from the Ukraine conflict that the FDF lacked the readiness and response 
time compared to Crimea. 275 The only part of the Finnish military ready to respond to a 
rapid escalation was some of FINSOF. The reaction to Russian hybrid warfare in Ukraine 
became a reorganization of FDF and its budget priorities. 

To improve readiness and response time, the FDF established several rapid reaction 
forces (RRF) called “ Valmiusyksikot .” The new forces consisted of company-sized infantry 
units trained in small-unit tactics supported by helicopter to secure mobility. 276 These units 
are responsible for the first responder duty in case of a national crisis from a hybrid attack 
directed at Finland. The rapid reaction forces are equipped and trained for battles equal to 
the ones seen in Crimea and will produce resistance until the rest of the FDF and total 
defense concept get mobilized and are ready to fight. Post mobilization, the Finnish army 
divided into three tiers: 277 first, the best equipped and trained operational forces; second, 
the regional defense forces focusing on securing Finland’s territory; and third, local 
security forces organized to secure infrastructure and military installations. The Finnish 
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annual defense report states that along with the rapid reaction forces, FINSOF is 
responsible for ensuring Finland’s readiness and initial response in times of a national 
crisis. 278 Also, to maintain Finland’s security system’s readiness and FINSOF’s mobility, 
an approved mid-life update will amplify Finland’s rotary-wing. These actions are some of 
the hybrid countermeasures taken in Finland in response to the current international 
development. 

One part of FINSOF’s mandate and responsibility is to support the Finnish police 
on request. FINSOF’s order is similar to the counterterrorism mandate NORSOF bears in 
Norway. The police can forward the request due to a lack of internal resources or police 
capabilities. On June 5, 2019, operational leaders from the Finnish police SOF and Finnish 
military SOF described in interviews how the police and military communicate and 
cooperate against hybrid threats. To speed up the request for FINSOF presence in a police 
matter, the Finnish security system has two parallel chains of command: one official and 
one unofficial. In the official chain of command, the local police commander requests 
through the national jurisdictional sector up to the ministry level in the Finnish MOI. At 
the ministry level, the request will be considered and further authorized, and pending the 
approval of the request, it will reverse through the chain of command from the Finnish 
Ministry of Defense and eventually display as an order to the tactical FINSOF units. 

The unofficial request—and the key to a rapid response—comes directly from the 
local police commander to the FINSOF unit, which works parallel to the official request in 
the chain of command. This unofficial request functions as a warning order for FINSOF, 
which thereby can start its combat preparations immediately. The early warning gives the 
FINSOF units time to alert and mobilize their operators and key personnel, at the same 
time as the official process proceeds. The military FINSOF is also allowed to advance and 
move its tactical units to the location; its presence is requested before any acknowledgment 
from the MOI. When the request eventually is authorized, military FINSOF is then 
typically already mobilized and locally united where the police need military support. On 
the other hand, if the request is declined, the military FINSOF units stand down and wait 
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for further orders, or are extracted from the location. The result of the two chains of 
command is a more effective response and support to the police when requested. It is not 
hindered by undesired bureaucracy in a time when urgency is essential, but at the same 
time it ensures that the Finnish constitution is upheld and that military actions are 
necessary. For Norway’s security apparatus, implementing the Finnish interdepartmental 
communication at all levels can prevent unnecessary bureaucratic delays, as well as break 
down organizational misunderstanding and improve cooperation. 

2. The Netherlands 

To engage in CT operations, the commander of Dutch Dienst Speciale Interventies 
(DSI) reports and communicates with the Dutch Ministry of Justice (MoJ). To avoid 
bureaucratic hold-ups in an urgent situation or national crisis, the commander of DSI has 
three pre-described engagement situations already approved by the MoJ. These pre¬ 
described situations allow the commander of DSI to engage all three tier-levels in case of 
an ongoing—or suspected—domestic terrorism attack, even if the DSI commander is not 
able to communicate with national leadership and the Dutch MoJ. In this manner, the pre¬ 
described engagement situation enables quick response without the delay of official 
authorization when executing domestic CT missions. 

The DSI’s pre-described engagement scenarios compare to a generic military 
CONOPS at the tactical level. A military CONOPS is “a clear and concise statement of the 
line of action chosen by a commander to accomplish his given mission,” 279 and “includes 
all operational aspects of the operational factors time, space, forces, and information, 
balanced sufficiently within acceptable risks.” 280 In military campaigns, military 
commanders apply CONOPS as the commander’s tool to make sure the subordinate tactical 
commanders operate within the overall campaign commander’s intent, work towards the 
same strategic objectives, and are within the national and international legal framework set 
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for the given campaign. To be allowed to execute a mission, a tactical unit must produce 
and present a CONOPS to its higher level of approval beforehand. If a set of tasks are 
similar, one may create a generic CONOPS to avoid unwanted bureaucracy and delay. An 
approved generic CONOPS serves as an operational approval given from higher authorities 
for more than one operation; however, it only applies to a specific geographical area, under 
very detailed and unambiguous regulations and limitations, and generally for routine 
operations. DSI is organized, trained, and prepared as a joint cross-sectoral organization to 
hinder terrorists from succeeding on Dutch soil. In this way, the pre-described scenarios 
controlling DSI’s engagements share similarities to a generic CONOPS framework, as both 
examples are a higher authority’s tool to command and control its forces successfully 
without bureaucratic barriers. 

DSI’s CONOPS focuses on the terrorist as the subject rather than on describing the 
environment or scope of the operation. With the terrorist as the subject, the DSPs CONOPS 
focus on describing the legal framework in the event of possible terrorism, and within this 
description are branches corresponding to three situations: The first situation describes the 
DSPs guidelines and restrictions during an interruption of a terrorist act where the terrorist 
is approaching his/her target. The second described scenario guides and regulates the DSPs 
intervention during a terrorist attack, while the third scenario defines DSPs actions after a 
terrorist attack, namely, the chase after a terrorist attack. Conclusively, the MARSOF 
operators relate to three different recognizable situations they may act upon which clearly 
state the MARSOF operator’s options and, importantly, their limitations. Therefore, in 
times of broken communication in the command structure, without an immediate execution 
approval from the DSI commander, the MARSOF tactical units are aware of their 
operational framework and may operate autonomously. 

When mustered for a terrorist attack, the DSI forces are always in a supporting role 
to the local police. Supporting means that the local police are in charge of the investigation 
and usually are the on-scene commander, while the DSI supports and enhances the local 
CoP and provides capabilities the CoP usually does not possess. To secure national law 
and avoid misuse of military forces, military assistance from MARSOF is regulated 
through Dutch police law, which defines and limits MARSOF’s responsibilities to acts of 
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terrorism only. The MARS OF operators are not allowed to proceed in any other police 
duties. To assure its operators’ jurisdictional understanding, the MARSOF operators are 
educated and trained to entirely understand the Dutch police law before entering the M 
squadron or any national CT operations. When the MARSOF operators become 
operational, the operator is treated as a police officer and held personally accountable for 
every action committed during a DSI CT operation. 

In 2019, the Netherlands experienced a domestic terrorist attack in its city of 
Utrecht. Immediately, after receiving indicators of the ongoing attack, the DSI system 
engaged “full alarm,” which means to muster all three tiers of DSI. Within 15 minutes after 
the first reports, the first SWAT teams arrived at the crime scene. 281 At the attack site, the 
terrorist had already committed his terrorist acts and escaped the local situation by 
hijacking a car nearby. Thus, the response forces from DSI immediately recognized its 
third pre-described situation, which describes the chase after a terrorist attack. Five minutes 
after the DSI SWAT teams arrived at the scenario as the first responders, and 20 minutes 
after the DSI alarm sounded, the DSI AI teams placed Utrecht under “lock-down”— 
meaning closing all access and routes of escape for the terrorist. As the terrorist escaped 
from the crime scene, the already established CONOPS for chase secured the operational 
approval and rapid response from the DSI. A terrorist attack including mass shootings such 
as the one in Utrecht leads to local panic and chaos; however, as the DSI’s third scenario 
establishes guidelines that augment the collective operational understanding, the system of 
established CONOPS helped the CoP to solve the crisis rapidly. The DSI arrested the 
terrorist after a six-hour-long chase, and the operation, from a counterterrorism perspective, 
was successful. Throughout the situation, the local CoP in Utrecht led the efforts and had 
DSI in support of his countermeasures in response to the terrorist attack. 
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3. 


Discussion 


In Norway, the police request for military support is a formidable process. Despite 
a review and modernization of the process in 2015, the system still requires that the local 
CoP process a request through the police directorate. If the POD complies, the request is 
processed through the MoJPS, which repeats the acknowledgment and reaches out to the 
MoD. 282 Finally, upon approval, the military national joint headquarters orders the 
appropriate military response to support the CoP. In total, there are six to eight decision¬ 
makers who must agree with the CoP’s local perception and situational understanding to 
deploy military support to the CoP. The described bureaucracy hinders an effective 
response. The CoP has concluded that the police’s capabilities are not currently adequate 
to achieve sufficient security of the society. If possible, the CoP would most likely request 
directly to the desired supportive unit as time may be a critical factor. Yet, the CoP’s 
request will be challenged through six to eight “no-filters” who are not familiar with the 
local situation. No-filters means that the bureaucracy’s only impact on the request is to 
decline or alter the specification. If all filters approve the request, the only effect of the 
bureaucracy is to slow down the ability to respond rapidly. While “traditional hierarchies 
have slow decision cycles and ineffective interagency mechanisms,” 283 hybrid threats 
require a short linkage between NORSOF and the decision-makers on-scene. Naturally, the 
process by which a police unit requests military support needs proper supervision to 
maintain control over both an appropriate enforcement of the Norwegian law and public 
rights, and to ensure the state’s control over its resources. Nevertheless, as described, a 
hybrid scenario challenges the Norwegian bureaucracy and its responsiveness. 

A bureaucracy, as described, is an undesirable framework in a situation with an 
urgent need for rapid response. Nor does it harmonize to filter an SOF request “through a 
hierarchy of conventional-force commanders” unaware of the capabilities or qualities 
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NORSOF enjoys. 284 Norway’s response system for deploying NORSOF to a national 
situation may develop and improve by learning from the Finnish and the Dutch examples. 
The current non-communicative model (see Figure 11) in the Norwegian system not only 
interferes with and hinders a request for needed support, but also blocks the desired cross- 
sectoral understanding and personal relations fundamental for good cooperation. 285 During 
the episode in the Barents Sea in 2005, the operational and strategic military level in 
Norway was the only one who communicated with the local authorities—the governor of 
Svalbard [Sysselmannen], The involved tactical units from the MoJPS—meaning the 
governor of Svalbard [Sysselmannen ]—communicated through their own department and 
the jurisdictional branch, while the military unit—FSK task unit (TU)—communicated 
through the national joint headquarters and the MoD to develop situational understanding 
and to get answers for the TU’s request for information. At the given time, cross-sectoral 
communication was not needed to solve the situation; however, it proves that the given 
bureaucracy does not induce or promote desired cross-sectoral communication. While the 
outcome would probably remain the same—meaning that NORSOF units were not 
tactically employed—it is presumed that both personal understanding and knowledge of 
FSK’s capabilities and a prior communication and relationship would ease the governor’s 
feelings about NORSOF presence under his command. In a potential future crisis, cross- 
sectoral communication on a tactical level is vital to gain a shared common situational 
understanding and awareness. 286 

The Finnish two-way request for support system maintains an early warning 
system. As visualized by Figure 17, a similar system where the local CoP can engage and 
communicate with NORSOF tactical units directly would allow NORSOF to prepare and 
forward its tactical units without delay, and as necessary, it would enable NORSOF a better 
situational understanding of the problem the tactical units engage. Yet, to engage in such 
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communication, it is also vital to both know and understand each other’s capabilities and 
modus operandi. Knowledge, trust, and reliance develop over time through personal 
relations and communication. The Finnish security model exemplifies how Norway can 
improve its cross-sectoral cooperation and rapid response efforts. Nevertheless, as the 
Finnish example demonstrates, to be efficient on a tactical level, Norway’s national 
leadership must advocate and push for an evolved security organization, especially at the 
tactical level. 

The suggested NORSOCOM liaison element will function as the cross-sectoral 
door-opener. To improve NORSOF’s needed responsiveness, the tactical units must be at 
the center of focus; however, to introduce NORSOF’s tactical capabilities and knowledge, 
the liaison element can be the initial contact, creating an understructure for cultural 
understanding and a shared cross-sectoral acknowledgment of what is operationally 
important and how the police and NORSOF could work together. After the liaison element 
has shared NORSOCOM’s message, joint exercises and personal relationships between 
tactical units in both sectors will influence and contribute to improving the cross-sectoral 
cooperation to further securing Norway’s interests. 

The joint exercises between NORSOF and the police should engage police from all 
levels and locations. Historically, NORSOF conducts annual exercises with the Norwegian 
police’s elite SWAT team Delta [ Bereclskapstroppen ]. 287 These annual exercises normally 
focus on counterterrorism, assault forces, and are often linked to terrorism threatening the 
Norwegian oil sector, 288 and these exercises engage and train all levels in both sectors 
from strategic down to tactical. Hence, the exercises are expensive in terms of financial 
and human resources. The annual cross-sectoral exercises are important to test Norway’s 
counterterrorism abilities; however, they usually are focusing on the elite units. Hybrid 
threats, on the other hand, demand steady coordination and partnership between agencies 
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and departments at all levels. 289 To further develop the cross-sectoral collaboration and 
focus on hybrid threats and scenarios, NORSOF should involve the police districts instead 
of having its elite focus. As the training is as much about building rapport and relationship, 
the exercises can be of a lesser economic scale in force and funding and still have the 
desired effect. Eventually, a request for support from the police is due to a lack of internal 
resources or potential among the police. Thus, in NORSOF’s aspect of fighting hybrid 
threats, personal knowledge regarding available resources in the police districts is more 
important than being able to operate side-by-side at the elite level. 290 A critical 
transformation, then, is to not train only with the elite police forces. On the contrary, by 
training only with the elite force Delta, NORSOF is potentially in danger of presenting 
itself as an exclusive resource, not available for the ordinary police force. By downscaling 
its scope in cross-sectoral exercises and inviting the police districts to everyday training, 
NORSOF enhances the common ground and lowers the police’s threshold to request 
support. By doing so, NORSOF’s ability to rapidly respond to a hybrid scenario will further 
progress. 

Norway’s vast countryside and widely dispersed population challenge its security 
responsibility. To face the challenge, the Norwegian MoJPS has inaugurated several 
successful means to preserve the public respect for the often remote local police station, 
frequently found in peripheral and rural areas of Norway. Some of the basic principles 
stated by the MoJPS are that the police force is a decentralized organization, and the police 
officers are a reflection of the society and its ideals. 291 Also, the Norwegian police’s role 
in the society is stated to be of a civilian character, and the Norwegian police officer should 
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not specialize but remain a generalist and all-rounder in the police profession. 292 In 
general, the basic principles function well in enabling typical Norwegian police officers to 
maintain order and fight local crime. While the local police officers are responsible for 
maintaining local order, though, the police’s responsibility for hybrid scenarios may be 
challenged as it represents a need for a more specialized and trained response. 

Hybrid scenarios include synchronized multi-domain hostile efforts. The multi- 
domain challenge is not typical for Norwegian police and requires support from counter 
hybrid organizations and specialists. 293 Though as Norway does not possess any forces as 
such, NORSOF, as described, is Norway’s force of choice in gray zone challenges. 294 
Furthermore, the Norwegian MoJPS acknowledges the problems with modern hybrid 
threats and gray zone dilemmas, and states that the police should cooperate with “other 
authorities and organizations entrusted with tasks that affect the police’s field of work as 
far as rules given in or pursuant to the law do not preclude this.” 295 Yet, as the identifying 
factors of hybrid warfare include complexity and rapidness, it is challenging for a local 
CoP to both recognize the hybrid scenario occurring, and request NORSOF’s presence. To 
support the CoP, NORSOCOM may learn from the Dutch DSI’s CONOPS system, and 
establish NORSOF CONOPS for the CoP to improve the Norwegian response system to 
hybrid scenarios. 

The Dutch intention with its predefined DSI CONOPS is to avoid delay associated 
with bureaucratic processes and miscommunication in situations where time is critical. The 
CONOPS predefines the MARSOF scope of practice; it enables preset guidance and allows 
the ground forces to enter the situation with higher confidence and better control for its 
legal ground in a complex situation. While the Dutch CONOPS is limited to 
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counterterrorism situations, NORSOF could create similar national regulations and 
operational sketches for gray zone operations in Norway. By identifying the legal 
framework and establishing the military scope of practice, CONOPS, as such, would most 
likely enable the ground force’s potential and, by that, strengthen local authorities in 
situations when communication with centralized authorities is obstructed. 

NORSOF’s generic CONOPS for hybrid threats must give the CoP tactical options. 
As the hybrid threats may present as vague and complex, NORSOF’s CONOPS should 
present paradoxically clear and precise, and not complicate the situation further for the 
CoP. Similar to a handbook or a manual, the predefined CONOPS should support 
Norway’s 12 police districts to recognize potential threats and provide the local CoP with 
alternatives and understanding of what NORSOF can facilitate as a force multiplier. 
Moreover, a generic hybrid threat CONOPS as described provides a cross-sectoral body of 
shared knowledge and understanding, which in times of urgency benefits all decision¬ 
makers at different organizations. 296 Thus, the CONOPS development process must, 
therefore, involve experts embracing the various aspects of the potential problem. At a 
minimum, the process of generating the CONOPS should include legal expertise along 
with tactical specialists, which collectively can create concrete guidelines for the CoP to 
support further the local leaderships’ ability to rapidly understand in which situations they 
should request support from NORSOF, and how to proceed effectively. 

D. SITUATIONAL COMPLEXITY IN A NON-COMMUNICATING CHAIN 

OF COMMAND 

One of Russia’s keys for success during the initial phase of a hybrid attack is to 
create situational complexity and broad operational confusion. By intentionally 
establishing complexity and confusion as such, the Russian campaign intends to paralyze 
its adversaries’ reaction and mobilization to create enough maneuverable space to engage 
the next phase of the conflict: either a further escalation as seen in Crimea, or giving Russia 
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time to complete its business and withdraw. 297 Regardless of the Russian actions’ end- 
state, the result in both situations leaves the attacked nation in a fait accompli , 298 The 
desire to refrain from escalating is a natural response for the weaker side in a conflict. As 
a national fight-flight-freeze situation, where flight is not an option, freeze becomes the 
preferred deliberate response to not provoke the stronger adversary and thereby escalate 
into a military conflict. 299 Through its engagements on Crimea, Russia demonstrated its 
ability to utilize an adversary’s reluctant executive response. The described situation in 
2005 in the Barents Sea presents some of the same factors. The situation in the Barents Sea 
was not a state-driven threat, and—most likely—the correct decision was made not to 
employ military power to the case; however, the situation illustrates the complexity for the 
small-state government challenged by a more significant power. 300 At the moment the 
situation occurred, the Norwegian government was newly elected and seated and instantly 
challenged by an international diplomatic issue. While tactical and operational levels 
prepared, the situational complexity at the political level tested the national leadership first 
to execute SOF response, then later recall its decision and halt the employment. The 
subsequent investigation reports concluded that the governmental reaction was appropriate 
according to the situation, and stated that in similar situations it would be natural for the 
involved ministers to participate in special cases such as the ones in the Barents Sea since 
the impact of these cases would necessarily concern more than one ministry. 301 The report 
further emphasized the complexity in the situation as very unusual where the different 
decision-makers in the Norwegian government do not share the same understanding of 
which principles to decide by or appropriate reactions to follow. 302 Such situational 
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complexity and confusion between ministries and authorities resemble the factors 
combined in modern hybrid threats, harming multiple levels of the society and giving the 
attacker plausible deniability through proxy-forces or unmarked soldiers. 303 

A second finding from the hybrid scenarios related to the situational complexity is 
the flow of information and lack of communication. 304 By engaging in massive media 
campaigns with misinformation and bending the truth, Russia has modernized the nonlethal 
concept of softening its target by creating a favorable environment for its power projection. 
Prior to infiltrating and annexing Crimea, Russia intensified its influence campaign among 
the Ukrainian population. Thereafter, during the critical initial phase, Russia disconnected 
the Crimean peninsula by taking control of the regional communication system and thereby 
hindering Ukraine authorities from communicating and conducting national command and 
control. 305 Furthermore, when predicting the operational environment and keeping in mind 
the Russian electronic warfare capabilities and the recent GPS jamming in Northern 
Norway, one should consider the vulnerability of the electronic domain, giving the 
Norwegian security apparatus’ response an ambiguous information base and lack of critical 
inter-communication in the chain of command. 306 To understand the complexity of the 
situation in terms of communication, it is important to visualize a hybrid scenario similar 
to the 2005 Barents Sea situation that includes a filter obstructing communication between 
central and local authorities, and a disjointed informational picture. For local authorities, 
such a situation means a consequent lack of support, both logistical and consultative. The 
disconnection from a centralized government places the local authorities in isolation. This 
study’s described situation with the masses of refugees entering from Russia into Norway 
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in 2015 shows how the police in Finnmark struggled with the masses before the central 
authorities realized the scope of the situation. The finding indicates that the situational 
complexity is non-regional and may affect Norway as well. By applying that same local 
situation to a larger national critical situation, Russia found a weak spot in the 
communication between Norwegian local and central police authorities, leading to 
misunderstanding and miscommunication for several weeks before the situation in 
Northern Norway returned to normal. By exploiting the general refugee crisis in Europe, 
Russia created chaos in Finnmark county for a short time. 

From the government’s and central authorities’ side, the described tactical tools of 
disinformation and lack of communication represent isolation from the local scenario and 
detach the Norwegian government’s ability to lead and affect the current situation. 
Furthermore, if the Russian influence campaign is sufficient, the widespread 
disinformation will generate a similar situation as described in the “Hemmer-report,” 
where authorities do not share the same situational understanding, and as different rules 
apply to different situations, have no unified understanding of appropriate countermeasures 
rules. 307 In addition, the hybrid tactical tools may disconnect Norway’s current central 
leadership for an indefinite timeframe. 308 The lack of central leadership disables both the 
strength to escalate or de-escalate and, as importantly, disables the government’s 
proficiency to produce adequate support for the situation. In essence, a tactical 
environment, as such, affects Norway’s countermeasures. The Russian tactical tools 
creating situational complexity may drive Norway’s response to rely upon local situational 
understanding and local resolve to establish required remedies without being able to 
communicate with central authorities. 309 Naturally, for the strategic leadership in Norway, 
such reliance must be a central premise when deciding a national security model’s 
hierarchy and functions. Correspondingly, at the operational level, the joint headquarters 
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should include frames for tactical autonomy as part of the operational contingencies when 
planning its countermeasures. 


For NORSOF, hindered communication presents new challenges. The ambiguous 
information base and potential lack of chain-of-command communication challenge the 
concept of C2 and must be included in the contingencies when task organizing and 
planning a NORSOF countermeasure. Typically, “dominance in the realm of command 
and control, communications, computers, intelligence, surveillance, and reconnaissance 
(C4ISR) is vital to the success of SOF operations.” 310 Over the last two decades, 
NORSOF—as with most allied NATO SOF—has been shaped by the global war on 
terrorism, more precisely in Afghanistan and the fight against the radical Islamists in Syria 
and Iraq. Although NORSOF has gained tactical experience and operational development 
in the stated theatres, it has also unfortunately become accustomed to technological 
superiority on the battlefield, both in terms of maneuverability and communication. When 
fighting radical Islamists and terrorist organizations, NATO SOF operations are 
asymmetrical; not just due to NATO’s adversary presenting as a non-combative and not 
following any international regulations, but also asymmetrical because of NATO’s 
dominance with superior technology, air-dominance, and supreme communicative 
systems. In a hybrid scenario with an adversary such as Russia, the situation may present 
in reverse, where the Norwegian security apparatus presents as technologically equal or 
inferior to its adversary. 311 The inferiority must be incorporated in the Norwegian 
contingency planning when preparing for a response to a hybrid scenario. 

A deployed NORSOF task force, incentivized by a hybrid scenario, must, therefore, 
be organized to balance the complexity. By its nature, an SOF is built to achieve objectives 
in the gray zone by adaption and innovation. 312 To restore the situation’s equilibrium, 
NORSOF must employ its organizational flexibility and structure its countermeasures to 
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fight the described hybrid tools. 313 In a potential crisis where the Norwegian armed forces’ 
national joint headquarters deploys NORSOF in support of a local situation, the SOF task 
force should prepare for conditions where the forwarded force’s communication with 
higher authorities is hindered. A lack of communication in the chain-of-command 
challenges the forwarded force’s ability to act and react according to the national 
government’s will and decisions. 

1. The Netherlands 

The Dutch efforts to avoid undesired bureaucracy also enable tactical autonomy. 
The described CONOPS system allows the MARSOF operators to enter a dangerous and 
stressful environment with tactical and situational confidence as the operators know their 
limitations and options during a terrorist attack in the Netherlands. The CONOPS consents 
to the countermeasures, from the political level, through operational management and 
down to the ground forces, and by that ensures that Dutch law rules during domestic armed 
engagements. The Dutch CONOPS system focuses on the framework and the terrorist as 
the subject; hence, the CONOPS becomes generic for Dutch counterterrorism in general 
and is not tied to any region or situation. By doing so, the DSI’s CONOPS system mandates 
the ground forces an autonomic response capability in any given terrorist attack in the 
Netherlands. Furthermore, when engaging in national counterterrorism, MARSOF 
operators uniform themselves as police forces. By doing so, the DSI seeks to gain unity of 
command and unity of effort in national counterterrorism. Normally, the MARSOF are 
equipped like and wear the standard Dutch military camouflage; however, as the DSI alarm 
is set off, the reaction forces from both AI and the MARSOF’s M-squadron will present as 
police officers. This is a legitimate operational procedure as the MARSOF operators 
operate under Dutch police law and answer to the local chief of police during the situation 
advances. Besides, the DSI also avoids bringing more complexity to the situation by having 
a reaction force appearing in several uniforms, with different equipment and 
communication systems. In summary, the pre-defined CONOPS enables the Dutch security 
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apparatus autonomy and strengthens the national crisis management during urgency and 
situational complexity. 

2. Discussion 

A pre-described foundation, such as the suggested CONOPS framework, would 
support Norway’s hybrid countermeasures. By creating such frameworks, Norway would 
augment several parts of its national hybrid challenge. First, the described framework 
would clarify each respective decision-maker’s role at the tactical and operational level, 
and yet instruct common interdepartmental concepts. 314 A description, as such, clarifies 
national and local authority and procedures in gray-zone challenges. Second, the described 
CONOPS will induce a common language between the cultures and situational 
understandings and further enable shared sets of values. 315 A common institutional 
language is essential when referring to the interdepartmental concepts and “is required to 
effectively communicate plans and roles” in local countermeasures to a hybrid scenario. 316 
Third, by introducing the chain-of-command, applicable legal aspects, and optional 
capabilities, a common CONOPS will remove several cross-sectoral biases. In general, the 
local authorities’ confidence and ability to enforce and execute countermeasures will gain 
from a national CONOPS system. 

In times of urgency and crisis, an operational framework is important for NORSOF. 
A hybrid scenario CONOPS will give the deployed SOF operators confidence to take a 
stand, without hesitancy or irresolution. 317 Similar to the Dutch counterterrorism 
CONOPS, a Norwegian hybrid scenario CONOPS must adequately—and intelligibly—set 
the legal framework that further grounds a proper and prudent NORSOF response in times 
of no communication and autonomy. In Norway, the police force is by its nature and culture 

314 Sundf0r, “Effectiveness of Forces and C2 in a Semi-Chaotic Environment- an Integrating 
Methodology,” 18. 

315 Kogut and Zander, “Knowledge of the Firm, Combinative Capabilities, and the Replication of 
Technology,” 389. 

316 Sundfpr, “Effectiveness of Forces and C2 in a Semi-Chaotic Environment- an Integrating 
Methodology,” 18. 

317 Simonsen, Tilforsvar av landet- Rettslige rammer og grcisoner ifred, krise og krig [In Defense of 
the Country- Legal Framework and Greay Zones in Peace, Crisis, and War], 1:80. 
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more autonomous than Norwegian military forces. Norway’s military forces are used to a 
chain of command and control regulated by orders and the commander’s intent, and the 
leadership is tied to strict political control. In the MoJPS, the different CoPs in Norway’s 
12 national police districts stand more freely to solve day-to-day missions and provide 
security to the society. 318 Political control over the military and distribution of state power 
and authority, as described, is a cornerstone in modern democracies and a natural part of 
the Norwegian society. In a hybrid scenario, however, the culture of order-based 
maneuvers may hinder an appropriate response in a situation where communication is 
denied and the situational complexity high. Norway’s security apparatus, both the civil part 
and the military, increases its resilience by distributing CONOPS with knowledge about 
what to expect and how to proceed. 319 The described CONOPS may improve this 
hindrance by controlling the use of power and escalation in situations with a lack of 
communication in the chain of command, due to the CONOPS’ guidance through laws and 
regulations, regulation of power projection, and instructions of appearance and choice of 
profile. 

Cooperation between the police and NORSOF may benefit from identical profiling. 
The Dutch approach of military personnel using police equipment and uniforms intends to 
affirm unity of command and unity of effort in the CT force and insures that the police are 
accountable and responsible for the CT measures taken. In a gray zone scenario, however, 
the same means could support the political incentive of not escalating the situation. As 
political sensitivity remains a cornerstone of the national response to hybrid threats in a 
gray zone scenario, military uniformed and military equipped personnel as a national 
response to threats that aim to appear civilian may escalate a situation. Furthermore, it may 
stimulate military counter-reaction. Thus, as long as the operation is under civil command, 
military support may benefit political stability by appearing as police officers. In situations 
where the CoP identifies capability deficiency, such as inspection of a suspect ship, the 
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NORSOF detachment assists the CoP to a greater degree by maintaining a low profile, 
rather than donning camouflage uniforms and large helmets, armed with long rifles. Thus, 
NORSOF’s choice of tactical profile and actions when applied in a gray zone crisis 
becomes key to avoiding escalation of the conflict. By learning from the conflicts studied, 
it is natural to assume that during an escalating crisis between Norway and Russia, several 
versions of the truth will rule, and the media’s versions and subversion will represent a 
major part of the escalating factors. Operational security (OPSEC) and NORSOF’s 
formations and operational presentation become essential to enable quick to support and 
force multiply the CoP’s ability to control the situation without escalating orbringing more 
instability and confusion to the situation. This indicates that NORSOF must appropriately 
enhance the CoP in a clandestine—or low-profile— manner. 

3. Germany 

Pre-determined CONOPS, as described, supports NORSOF’s autonomy and likely 
facilitates the desired cross-sectoral partnership as well; however, it does not remove the 
situational complexity inherent in the current Russian tactics. The complexity necessitates 
a robust NORSOF tactical C2 system, especially if deprived of support and chain-of- 
command communication. In a gray zone crisis, tactical actions may have a strategic 
impact. The loss of military communication with other units and the higher chain of 
command is as old as radio communication itself, and typically, military units plan for 
contingencies such as “no-coms” to preserve the operational tempo. Nevertheless, due to a 
hybrid scenario’s short span from tactical maneuver to strategic relevance and the 
complexity presented by cross-sectoral dilemmas, sufficient contingency plans are difficult 
to implement, and the necessity for management, coordination, and communication may 
be imperative in politically sensitive situations. Yet, as Russia has already demonstrated 
its ability to obstruct communication, NORSOF’s prepared countermeasures should be 
organizationally synchronized to face the complexity robustly. 

To increase NORSOF’s C2 potential and its ground forces’ ability to work 
effectively in an operational environment with high situational complexity and uncertainty, 
NORSOF could learn from the German army’s special operations forces [Kommando 
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Spezialkrdfte ] (KSK), which altered its ground forces leadership’s structure to improve 
KSK’s robustness in politically sensitive matters. In an organizational introspection in 
2016, the KSK discovered that its company structure could be more efficient and modified 
to confront current challenges better. In summary, the KSK altered its company structure 
from being a special operations task unit (SOTU) to a special operations task group 
(SOTG) equivalent. With its historical structure as a SOTU, the KSK needed to restructure 
and bring in capabilities outside of the normal company structure. When a company 
received a new tasking or a mission, the SOF company was not deployable before the KSK 
staff also reorganized its personnel to fulfill the different required staff positions in the new 
task-organization. In its self-analysis, the KSK determined that the reorganization process 
was ineffective. As the KSK bears Germany’s national responsibilities for international 
hostage rescue operations (HRO) when German citizens are captured, the KSK understood 
that due to the political sensitivity and complexity, a more robust company structure would 
benefit KSK readiness and increase potential mission success. 

KSK’s reorganization mainly instituted two enhancements at the company level: 
first, it incorporated critical enablers and capabilities in the form of analytics and tactical 
specialists to meet the requirements needed to deploy as a SOTG. The former company 
structure included only badged KSK operators in the operative companies and had 
designated support companies to fulfill various combat support roles needed to be 
operational. By adding these support roles into the new company structure, the company 
commander could better control the personnel and equipment required if deploying the 
company. The new structure also enhanced both the internal relations between the 
operational and support staff and the operational understanding in the SOTG. 

The second alteration of KSK’s company’s reorganization was increasing the rank 
level and structure required to command and control a SOTG. In its old structure, the 
commander of the KSK company was an army captain, whose rank and background could 
limit the internal KSK officer pipeline only. KSK believed that a level, as such, became 
too narrow in complex situations. When engaging a SOF company in tactical battles, the 
captain rank and limited political understanding may be sufficient in simple direct action 
engagements; however, it does not secure a holistic overview and good situational 
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understanding. As tactical engagements may have strategic consequences, the KSK 
commander wanted company leaders who had a broader view to understand operational 
significance and magnitude. Thus, in KSK’s new company structure, the company 
commander is a KSK Lieutenant Colonel (LTC). The company commander requirements 
require the LTC to be an officer from the KSK selection pipeline, but also—as relevant— 
to have accomplished a minimum of one posting outside of the KSK, typically a position 
pinned to the joint operational or strategic level in Germany. Also, to reach the LTC level, 
normally, the officer must attend the general staff college for promotion. Overall, the intent 
is to broaden and lift the rising company commander’s situational understanding and 
operational maturity to be better prepared to make the right decisions during complex 
situations. 

By leveraging its company structure to a SOTG level, the KSK enabled rapid 
deployment, internal competence, and personal knowledge. Simultaneously, it enhanced 
the KSK’s SOTG’s ability to face situational complexity with a more mature organization. 
When the KSK deploys a SOTG, the company commander becomes the SOTG 
commander, and his company the rest of the task group. Additionally, in the new structure, 
the company’s second-in-command (deputy) is a KSK major, selected through the KSK 
officer pipeline. During a SOTG deployment, the company deputy becomes the officer 
leading the operational center in the deployed SOTG, equivalent to a Chief of Staff. Hence, 
KSK’s new company structure improves KSK’s SOTG operational speed and 
independence and enhances the SOTG’s local C2. 

4. Discussion 

A potential crisis between Norway and Russia will most likely present with a highly 
complex operational environment—where the complexity is intentionally created by 
Russia. By learning from the KSK’s lessons learned, the KSK company structure may 
enhance a NORSOF counterforce in a crisis where Russia enforces its new tactics. As 
KSK’s new company structure facilitates a stronger foundation for sound decision making 
in complex environments, it may improve the Norwegian response in a hybrid scenario. A 
NORSOF SOTG similar to the new KSK SOTG structure would strengthen the NORSOF 
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ground force during cognitively demanding situations with an absence of communication 
in the operational chain of command, and blurry cross-sectoral threats challenging domain 
and authority—especially where tactical input may result in strategic output. 320 Strategic 
output means the assumed consequence of an action, not the actual action itself. 321 
Consequently, SOF’s modest footprint, especially in clandestine operations where the 
footprint is supposedly unseen, bespeaks NORSOF involvement in politically sensitive 
matters. Thus, the need for an SOF leader’s strategical understanding and insight is 
imperative: “Specifically, SOF members, especially in their higher ranks, need to acquire 
more education in strategy.” 322 As hybrid warfare increases situational complexity and the 
concern for consequences and a negative strategic outcome, the operators involved need to 
be prepared and the officers in charge must demonstrate broad and deep insight when the 
situation becomes blurred and ambiguous. 323 

By requiring joint service and encouraging a broad platform of NORSOF squadron 
commanders, NORSOF may promote more mental agility in its ground force commanders 
when deployed into a hybrid scenario. A more comprehensive understanding as such is 
essential, not just for organizational decision making, but for communicating with the 
civilian leadership, usually the CoP or the county governor. 324 A history of joint service 
will also make the SOF commander acquainted with cultural biases and languages. As 
described in the former KSK structure, a ground force commander only exposed to his or 
her respective SOF unit may be limited to his or her own organizational culture and SOF 
unit’s tribe language and may appear ineffective in the cross-sectoral communication. In 
summary, by boosting the ground force’s potential, especially its leadership, NORSOF 
increases its decision-making capabilities and further facilitates improved cross-sectoral 
cooperation and communication. 
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V. CONCLUSION AND RECOMMENDATIONS 


This thesis’s main objective is to improve Norwegian special operations forces’ 
ability to counter hybrid threats and hybrid warfare. To reach the desired end-state, the 
thesis addressed two research questions, the first of which identified the significant factors 
describing the operational environment during hybrid scenarios, and the second, examined 
llied SOF’s lessons learned when challenged by an operational environment driven by 
similar factors. 

To adequately address, fight, and deter hybrid challenges, Norway needs a 
counterforce able to operate cross-sectorally, rapidly, and autonomously. Russian hybrid 
power projection during the last decade has demonstrated a Russia not afraid to blur the 
distinction between targets of military or civilian character to reach its political objectives. 
During hybrid attacks, Russia retains plausible deniability as the Russian soldiers operate 
without any distinct identification tying them to Russia, and sometimes, without even being 
recognized as soldiers. In this manner, the Russian soldiers’ actions present as a civilian 
rather than a military problem. Furthermore, hybrid attacks are synchronized among 
sectors, and escalate quickly, without any significant warning. 

A. RECOMMENDATIONS FOR NORSOF AND NORWAY’S SECURITY 
APPARATUS 

Norway’s security apparatus is not organized to fight challenges as such. Long 
traditions of clear and firm boundaries between each ministry’s sectors are established to 
secure inter-departmental efficiency and lessen bureaucracy, simultaneously preserving 
compliance with the Norwegian constitution. While being bureaucratically efficient during 
peacetime, Norway’s security system is challenged by gray zone activity. The described 
fixed departmental boundaries and lack of communication between security organizations 
make cooperation and collaboration difficult and inefficient. During peacetime, the lack of 
cross-sectoral knowledge does not present as evident. However, as hybrid threats may 
involve multiple ministries and be perceived by the involved authorities in different ways, 
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Norway’s security apparatus needs to readjust its code of conduct to encounter the hybrid 
attack properly. Naturally, this readjustment must be done before any potential crisis. 

For NORSOF, this means that NORSOF should engage its potential partners in 
cross-sectoral communication and collaboration through informal meetings, exercises, and 
training. Such communication will build mutual organizational trust, and establish a 
common language and understanding between the partnering organizations. 
Furthermore—and as important—this communication will educate potential partners and 
enable knowledge of how NORSOF may support and enhance the Norwegian response 
during a hybrid scenario. Especially, as hybrid threats may appear of a civilian character, 
NORSOF should accommodate the cooperation between local authorities in Norway, 
meaning the police districts and the county governors. During a hybrid attack on Norway, 
the threat will most likely not be recognized as a state-driven threat before the situation has 
evolved, and therefore will initially remain a civil challenge; thus, the police will be the 
authority in charge. To make sure that the local authorities are fully aware of the resources 
available, and how NORSOF may amplify the Norwegian local response, local authorities 
must be given the opportunity to both appreciate and experience NORSOF’s capabilities. 

To enhance Norway’s countermeasures against hybrid attacks, this thesis suggests 
three initiatives by NORSOF: First, the Norwegian special operations command 
(NORSOCOM) should establish a full-time liaison element mandated to embrace local 
authorities by visiting, briefing, and educating local decisionmakers. The liaison element’s 
intent is to break down organizational biases and enhance the local understanding of the 
resources available. Currently, local authorities are unaware of the options in front of them 
and may appear biased by inaccurate information and rumors, which eventually may affect 
a CoP decision to request support by NORSOF. By allowing local authorities knowledge 
of NORSOF’s capabilities, procedures, and organizational structure, NORSOF can ensure 
local authorities are informed of options available to them. Thus, mutual knowledge and 
systemic understanding may increase local authority’s will and comfort regarding 
including NORSOF in their operations. 

Second, NORSOCOM should establish a generic CONOPS for hybrid scenarios. 

The generic CONOPS has a dual purpose. First, the CONOPS becomes a framework for 
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the employed NORSOF task unit, providing clear and concise guidelines for the task unit’s 
scope of practice according to the Norwegian constitution and directives from the Ministry 
of Defense. These guidelines will enhance tactical confidence, especially in situations 
when the NORSOF tactical unit is not able to communicate with the Norwegian joint 
headquarters (FOH). Second, the generic CONOPS may function as a manual for the local 
CoP, as hybrid attacks, as well as NORSOF capabilities, are not parts of a Norwegian 
CoP’s daily concern. By first introducing NORSOF’s capacities through the NORSOCOM 
liaison element and thereby providing the CoP with a manual as a guide, the intent is to 
augment the CoP’s ability to recognize a potential hybrid threat, and at the same time 
lowers the local authorities’ resistance to requesting support from NORSOF. 

Lastly, this thesis recommends an increase in NORSOF’s C2 abilities in its tactical 
squadrons. A hybrid attack produces significant situational complexity, and requires a 
broad understanding of the situation, the law, and the ability to anticipate the strategic 
outcome of any intervention conducted. In particular, situations where communication 
between the ground force and central leadership is hindered challenge the local leadership. 
By establishing a more robust C2 apparatus in the ground force, NORSOF facilitates a 
more substantial decisional foundation for the forwarded tactical squadron. 

Combined, these three organizational advancements will improve NORSOF’s 
ability to counter hybrid challenges. The three improvements focus outwards on how 
NORSOF may develop through cooperation with other security organizations in Norway, 
a critical feature for hybrid countermeasures. In this way, the suggestions are not focusing 
on internal reform or technological modernization, but rather on how to improve 
partnerships, as well as how to enable and support local authorities’ countermeasures. 
Overall, the proposed development provides NORSOCOM a low-cost opportunity. The 
challenge, however, is the discussed tradition and culture among the Norwegian ministries 
and whether the Norwegian government is ready to make such changes. The three 
suggested advancements challenge the traditional way, and will only be needed—and 
validated—should a hybrid crisis occur. 
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B. RECOMMENDATIONS FOR FUTURE RESEARCH 


Further studies should explore how NORSOF could become a strategic offensive 
tool for Norway’s hybrid countermeasures. The described and suggested measures for 
NORSOF to improve its effort in a future gray zone crisis with Russia can display as 
tactically offensive as a direct action measure. Nevertheless, such measures are 
strategically defensive in nature. They are designed to react and respond to initial 
engagement and thereby are a defensive initiative. SOF, on the other hand, usually are more 
offensive in nature, where the special operations forces have the initiative and cause their 
adversary to react. As a strategic offensive measure to hinder hybrid threats and warfare, 
special reconnaissance (SR) is a skillset for NORSOF to master. By employing SR, 
NORSOF could detect and address (potential) hybrid activity before it evolves into a 
national crisis. Over the last decade, NORSOF has, in its efforts in Afghanistan, worked 
consistently as a part of the apparatus searching for terrorists in Afghanistan. In NATO, 
this process is better known as F3EAD, a process that could be used in hybrid 
countermeasures as well. 

Further studies should address whether NORSOF’s total capacity needs 
adjustments. NORSOF’s mission capabilities are described as direct action, military 
assistance, and special reconnaissance in the allied joint publication (AJP) 3-5, the guiding 
umbrella document for NATO SOF, and in Norway’s joint doctrine. NORSOF is also tied 
to national counterterrorism in support to the Norwegian police. Overall, with its 
engagements on several continents, a new mission set—countermeasures to hybrid threat 
and warfare—may bring NORSOF’s capacity to its operational limit without 
compromising its qualitative operational approach. Further studies should analyze 
Norway’s need for increased human resources and funding to NORSOF’s already 
established units, or for the creation of a new SOF unit in Norway, specializing in gray- 
zone difficulty and crisis engagement. 
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